How do you verify the effectiveness of GAS remediation efforts over time?

• A. Only track the number of advisories created.
• B. Rely solely on annual audits.
• C. Track time to remediate and SBOM quality only.
• D. Track metrics such as time to remediate, number of fixes, reductions in surfaced vulnerabilities, and SBOM quality.

Answer: (D)

To verify remediation effectiveness over time, you need a mix of metrics that track speed, volume, risk impact, and asset accuracy. Time to remediate shows how quickly issues move from detection to fix, indicating process efficiency. The number of fixes reflects throughput and whether your remediation efforts are sustaining momentum. Reductions in surfaced vulnerabilities demonstrate real risk reduction, showing that fixes are actually lowering exposure rather than just being completed. SBOM quality ensures you have an accurate and up-to-date inventory of components, which is essential for identifying, prioritizing, and validating fixes across the supply chain. Together, these metrics give a complete, evolving picture of progress and health of the remediation program. Focusing on only one aspect—such as advisories, or annual audits, or just time and SBOM quality—misses important dimensions of effectiveness and can hide ongoing risk.