Patch Compliance Rate
The share of managed endpoints with critical and high severity patches installed within the patch SLA.
Formula
Endpoints with critical patches installed within SLA ÷ Managed endpoints × 100
Why Track It
Unpatched known vulnerabilities are the most common way into a client network, and a breach through a missed patch is the one the MSP will be blamed for. The per-client view shows where exceptions have piled up.
How It Is Measured
From the RMM patch report, count managed endpoints that have every critical and high severity patch released more than one SLA window ago installed. Divide by all managed endpoints that checked in during the period. Report workstations and servers separately and by client. Endpoints offline for over 30 days are reported as a separate exception list, not dropped.
Constraints
Depends on the RMM seeing every endpoint. Devices missing the agent are invisible, so reconcile endpoint counts against the asset list. Third-party application patches are often not covered.
Measurement Note
Decryption Digest sets 95% compliance for critical vulnerabilities within SLA as the effectiveness line, with actively exploited flaws patched in 24 to 72 hours on internet-facing systems and 7 days internally. Deferring patches through exceptions can hold the rate up while exposure grows, so report exceptions too.
Referenced In
- How Do I Price Security Services?Answer
- How Does HIPAA Apply to MSPs?Answer
- PSA vs RMM: What Is the Difference?Answer
- What Does NOC Mean?Answer
- What Is a QBR, and Why Does It Matter?Answer
- QBR (Quarterly Business Review)Glossary Term
- RMM (Remote Monitoring and Management)Glossary Term
- vCIO (Virtual CIO)Glossary Term
Related KPIs
- Mean Time to Identify and Contain a BreachThe average days from the start of a confirmed security breach to its identification, plus the days from identification to containment.
- MFA CoverageThe share of client user accounts enforced to use multi-factor authentication, with admin accounts tracked separately.
- Tickets per Endpoint per MonthThe average number of reactive tickets each managed endpoint generates in a month, a measure of how noisy the managed estate is.
Glossary and Answers
More in Security Operations
Whether the basic controls an MSP runs for clients are actually in place and working. These numbers show how exposed the client base is to the breach that ends a client relationship.
- Backup Success RateCentralized Services Lead
- Mean Time to Identify and Contain a BreachSecurity Lead
- MFA CoverageSecurity Lead
- Phish-Prone PercentageSecurity Lead
- Restore Test Pass RateCentralized Services Lead