Understanding Metrics for Agent Sara
The following section explains what each metric reveals about your exposure.
Your Exposure Dashboard
Agent Sara displays four key metrics showing your Patch Tuesday exposure for the current month:
The following table displays the details.
| Metric | What It Measures | Why It Matters |
|---|---|---|
| Impacted Assets | Example: 432 assets (7% of 6.2k total) | Demonstrates the extensive impact of this Patch Tuesday on your environment, aiding in the remediation efforts across servers, workstations, and cloud assets. |
| Vulnerabilities Exposure | Example: 920 findings (4% of 24k total) | Quantifies the operational workload introduced by this Patch Tuesday and helps teams plan remediation capacity. |
| Critical Vulnerabilities Exposure | Example: 234 findings (25% of 920 Patch Tuesday findings) | Identifies Patch Tuesday vulnerabilities that need immediate attention due to higher exploitability or significant business impact. |
| Unique Patch Tuesday Vulnerabilities ( Unique CVEs) | Example: 156 unique CVEs | Patch Tuesday vulnerabilities classified as critical by Qualys threat intelligence |
| Mean Time to Remediate (MTTR) | Example: 2 Days | Measures how quickly impacted vulnerabilities are being remediated, highlighting delays that increase exposure risk. |
Reading Your Metrics
These metrics show ONLY this month's Patch Tuesday vulnerabilities, not your total vulnerability count. This focus on current Patch Tuesday helps you prioritize immediate action.
High percentage of assets impacted?
Indicates this Patch Tuesday has a broad impact. Focus on creating a robust remediation plan that spans multiple systems.
Many critical findings?
Time-sensitive. These should be your highest-priority remediation targets. Plan fast-track patching.
High unique CVE count?
Indicates diversity of threats. Your remediation strategy needs to address multiple vulnerabilities, not just repeated exposure.
Compare findings to unique CVEs
If findings have unique CVEs, you have repeated exposure to the same vulnerabilities on multiple assets. Consolidated remediation may be efficient.
How Agent Sara Works
The four-step process from detection to remediation
Step 1: Patch Tuesday Identification
Agent Sara continuously monitors vendor Patch Tuesday advisories and internal CVE databases to identify all Patch Tuesday vulnerabilities released in the current month only:
- Detects active Patch Tuesday release month
- Monitors vendor advisories from major vendors
- Filters to current month only (excludes older vulnerabilities)
- Maintains an authoritative list of Patch Tuesday CVEs
By focusing only on the current month, Agent Sara keeps analysis focused and actionable, avoiding confusion with older Patch Tuesday releases.
Step 2: Patch Tuesday Exposure Analysis
Agent Sara uses your Qualys findings to determine your actual exposure to this month's Patch Tuesday vulnerabilities:
- Impacted Assets (Assets with ≥1 Patch Tuesday CVE)
- Finding Instances (Total vulnerability instances tied to Patch Tuesday CVEs
- Unique CVEs (Number of distinct Patch Tuesday vulnerabilities found)
- Critical CVEs (Subset classified as critical by your policies)
- Coverage Metrics (These metrics appear on Sara’s Agent Details page.)
- % of total assets impacted
- % of total findings accounted for by Patch Tuesday
- % of total critical findings represented by Patch Tuesday
Step 3: Actionable Output Generation
Based on the analysis, Agent Sara can generate:
Exposure Summaries
- Top affected asset groups
- Distribution of critical Patch Tuesday vulnerabilities
- Key hotspots, services, or business entities impacted
- Clear next steps based on severity and asset criticality
Prioritization Plans
- Only Patch Tuesday vulnerabilities (current month)
- Impacted assets within your selected task scope
- Criticality thresholds such as Qualys Vulnerability Score (QVS), Common Vulnerability Scoring System (CVSS), Exploit Prediction Scoring System (EPSS)
- Business entities or critical assets, if configured.
Draft Patch Jobs
- All assets with Patch Tuesday findings
- Mapped patches associated with those vulnerabilities
- Pre-filled scope filters and justification summary
Email Notifications
- Exposure summary email
- Prioritization plan email
- Patch job draft notification
- If a previous Patch Tuesday patch job exists but was not executed, Sara updates the same job.
- If the previous job was executed, Sara creates a new job for remaining or new findings.
Decision Handling: Always Human-Controlled
This is crucial: Patch jobs are NEVER executed automatically. All remediation actions require human-in-the-loop review and approval. This ensures Agent Sara aligns with your enterprise change-control and compliance requirements.