<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-vulnerability-trends
description: >-
  Analyze vulnerability trends across time to identify systemic weaknesses,
  measure program effectiveness, track MTTR improvements, and produce
  executive-level risk trend reporting.
domain: cybersecurity
subdomain: vulnerability-management
tags:
  - vulnerability-trends
  - metrics
  - mttr
  - risk-reporting
  - dashboards
  - kpi
  - executive-reporting
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Analyzing Vulnerability Trends

## Overview

Point-in-time vulnerability counts are noise. Trend analysis reveals whether your
vulnerability management program is improving, identifies systemic weaknesses
(recurring vulnerability classes), measures MTTR improvements, and provides executive
leadership with evidence-based risk posture reporting. This skill covers metric
collection, trend calculation, anomaly detection, and dashboard data generation.

Mode: `[MODE: BLUE]` — Operational metrics and program effectiveness measurement.

## Prerequisites

- Historical vulnerability data (minimum 90 days, ideal 12+ months)
- Vulnerability management platform API access
- Python 3.10+ with `requests`
- Dashboard platform (Grafana, Power BI, or Kibana)

## Key Concepts

### Core Metrics

| Metric | Description | Target | Frequency |
|--------|-------------|--------|-----------|
| MTTR | Mean Time to Remediate by severity | Critical <48h | Weekly |
| SLA Compliance | % remediated within SLA | >95% | Weekly |
| Open Vuln Count | Active vulnerabilities by severity | Trending down | Daily |
| Vuln Density | Vulnerabilities per asset | <5 high/critical | Monthly |
| Scan Coverage | % assets scanned in window | >98% | Weekly |
| Recurrence Rate | Vulns reappearing after fix | <5% | Monthly |
| Risk Score Trend | Aggregate risk score over time | Declining | Monthly |

### Trend Calculation

```bash
# Query Tenable.io for historical vulnerability counts
# Weekly snapshots for the last 12 weeks
for week in $(seq 0 11); do
  date=$(date -d "-${week} weeks" +%Y-%m-%d)
  curl -s "https://cloud.tenable.com/workbenches/vulnerabilities?date_range=1&filter.0.filter=first_found&filter.0.quality=date-lt&filter.0.value=${date}" \
    -H "X-ApiKeys: accessKey=$AK; secretKey=$SK" | \
    jq "{date: \"$date\", critical: [.vulnerabilities[] | select(.severity==4)] | length, high: [.vulnerabilities[] | select(.severity==3)] | length}"
done

# Calculate MTTR from scan data
# MTTR = average(remediation_date - discovery_date) grouped by severity and time period
```

### Anomaly Detection

```
Anomaly triggers:
├── Sudden spike: >20% increase in new criticals week-over-week
├── MTTR regression: Average remediation time increasing for 3+ consecutive weeks
├── Scan coverage drop: <95% asset scan coverage
├── Recurring vulns: Same CVE reappearing on >10% of previously remediated assets
├── SLA breach trend: SLA compliance dropping below 90%
└── New vulnerability class: Previously unseen CWE appearing in top 10
```

## Workflow

### Step 1: Collect Historical Data

```bash
node scripts/agent.js --action collect \
  --input /tmp/vuln_history.json \
  --output /tmp/trend_data.json
```

### Step 2: Calculate Trends

```bash
node scripts/agent.js --action trends \
  --input /tmp/trend_data.json \
  --output /tmp/trend_analysis.json
```

### Step 3: Detect Anomalies

```bash
node scripts/agent.js --action anomalies \
  --input /tmp/trend_data.json \
  --output /tmp/anomaly_report.json
```

### Step 4: Generate Executive Report

```bash
node scripts/agent.js --action report \
  --input /tmp/trend_analysis.json \
  --output /tmp/executive_report.json
```

## Detection

```yaml
title: Vulnerability Trends Detection
id: 72925a74-1158-45e5-a58e-f086af16b593
status: experimental
description: Detects suspicious activity related to analyzing vulnerability trends techniques in vulnerability management context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*analyzing*vulnerability*"
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.discovery
falsepositives:
  - Vulnerability scanner performing scheduled assessment scans
```

## Verification

- [ ] Minimum 90 days of historical vulnerability data collected
- [ ] MTTR tracked by severity tier with weekly granularity
- [ ] Trend dashboards published to security leadership
- [ ] Anomaly detection alerts configured for metric regressions
- [ ] Recurrence rate tracked and root causes investigated
- [ ] Quarterly executive risk trend reports generated

## References

- [NIST Cybersecurity Performance Goals](https://www.cisa.gov/cpg)
- [CIS Controls v8 — Measures and Metrics](https://www.cisecurity.org/controls)
- [FIRST CVSS v4.0 — Supplemental Metrics](https://www.first.org/cvss/v4.0/specification-document)
