What does vulnerability management cost? Run your own numbers

Series “From the first server to the report”, episode 3 of 9

At a deployment meeting, someone asks what it will actually cost. The subscription price is mentioned and the conversation stops. The other side of the comparison is missing: how much time does the company already spend collecting scan results, organising them and preparing information for IT or management? This is not an attempt to put a price on an incident or promise that work will disappear. It is a transparent calculation using your own assumptions.

The calculator below compares estimated labour costs in two scenarios. Enter the number of machines, the hours you spend or would spend on a manual process, your own hourly rate and the time that will remain with Secvalis. You provide the inputs. The result is only as sound as those inputs.

What you do manually today, or would need to start doing

By a manual process I mean the recurring work of collecting and assembling vulnerability information. An administrator runs a scanner such as Trivy, stores the results, organises the list, plans follow-up work and prepares a report. Across a fleet, results can come from different hosts and may vary in format or timing. Before the team can discuss them, someone needs to establish what is current and which machine each item belongs to.

Do not automatically count every administrator task here. Installing updates, testing applications, accepting risk and arranging maintenance windows remain separate jobs. The calculator concerns collecting and assembling vulnerability results. If you do not yet have a recurring process, choose “I need to start” and estimate how long it would take to run one regularly. Do not enter zero simply because the work has not been assigned to a timesheet.

“I do this manually today” fits when you already have a recurring process and can measure its active time. “I need to start” is for a company comparing a service price with the effort of setting up its own process. Both modes ask the same question: how many hours each month does, or would, collecting and assembling results take for the fleet you entered?

Why this work takes longer than expected

The calculator lists eight steps under H. Together, they make up the full cycle:

1. logging in to each machine and running a scanner (e.g. Trivy)
2. collecting and storing the results in one place
3. merging duplicates: the same CVE on many machines
4. checking each CVE: severity, known exploits, CISA KEV, whether the package is actually used
5. setting priorities and deadlines, the action plan
6. checking what from the previous list has been fixed
7. watching for systems out of vendor support (EOL)
8. a report or note for your manager, auditor or client

Scanning can be automated, for example with Ansible. It is not what consumes the time. Triage does. With 10 servers and 2,000-3,000 HIGH/CRITICAL findings per server, you get 20,000-30,000 items. How many unique CVEs remain after deduplication depends on how similar the servers are. Assuming 2,000-6,000, checking each one for three minutes would take 100-300 hours. In practice, teams group work by package and fix, and separately check only items in KEV, with high EPSS or important context. On top of that, distribution vendors backport fixes to older package versions. The upstream version number alone can then be misleading, and unclear cases have to be checked against the vendor advisory.

The estimates below are a model for 10 servers, not measurements from customers.

Step	Following month	First month
a. Login and scanning	1-3 h	2-4 h
b. Collecting and storing results	2-4 h	4-8 h
c. Merging duplicates	3-6 h	8-16 h
d. CVE review and triage	8-18 h	25-60 h
e. Priorities, deadlines and plan	4-7 h	8-16 h
f. Checking the previous list	3-5 h	0-2 h
g. EOL systems	1-2 h	2-5 h
h. Report or note	2-4 h	4-8 h
Total	24-49 h	53-119 h

The model assumes around 80-160 new or changed items each month that need a decision, and 3-6 minutes per item. The biggest unknown is how many items need a manual decision.

This work is tedious, unpopular and often postponed. I took part in audits. Every time, collecting and preparing the data was the most boring part, and it was put off for as long as possible. As a result, the work is not done every month, the backlog grows, and the audit evidence has a gap. That is why the table has a separate “first month” column. Budgeting 4 hours a month for 10 servers usually means that some steps simply do not happen.

Enter a settled month in the calculator, not the first one. Do not add the backlog to monthly savings.

How to measure active time

For a few cycles, record the time actually spent on each step. Separate a person's work from the time a scanner runs unattended. Note preparation, checking messages, collecting files, joining the data, reviewing the list, planning actions and preparing the report. You do not need a new time-tracking system. A note on the task or a small sheet with the date, scope and active time is enough.

If you have no measurement, enter your own estimate and label it as an estimate. For example, suppose it takes 30 hours a month for ten servers. This is an estimate, not a customer measurement. The table above shows a modelled range for a following month and the first month. Try fewer and more hours as well. That shows which assumption moves the result most.

The hourly rate also comes from your company. Use the net internal cost of an administrator's hour. It is not necessarily salary divided by working hours. Your company may include employer costs or use an internal charge-out rate. Apply the same rate to both scenarios.

How the calculator works

In both modes you enter the number of machines N, hours H, rate R and Hs, the hours that will still be needed each month after adopting the service. In "I do this by hand today" mode, H is the time you already spend. In "I still have to start" mode, H is the time doing it by hand would take. Hs is usually about 30 minutes a week, or about 2 hours a month: after logging in, you check what has changed and what is urgent. Secvalis runs the scans on the schedule you set once when installing the agent, and prepares the list and report. Allow more time in a month with an audit or an urgent KEV entry. The calculator also accepts Hs equal to or higher than H. The result is then negative, and it is shown as such.

The calculation is explicit:

• Today: H × R
• With Secvalis: Hs × R + plan price
• Monthly difference: today's cost minus the cost with Secvalis
• Annual difference, monthly billing: 12 × monthly difference
• Annual difference, annual billing: 12 × (H - Hs) × R - 10 × monthly plan price

This is a comparison of estimated labour cost and subscription. A positive result means that, given your inputs, today's labour cost exceeds the remaining effort plus the subscription. It does not prove that the company will reduce spending by that amount. Recovered time may go to other work instead of reducing payroll costs.

Set the number of billable machines before interpreting the result. At zero, the calculator does not choose a plan. Above 200 machines, pricing is individual, so there is no final difference to calculate. Blank hours do not mean zero time; enter a value only after measuring or estimating it yourself.

Plan thresholds and annual billing

The table shows monthly net prices and the subscription cost per machine. Annual billing is ten monthly payments. The thresholds are visible. From 11 to 25 machines you stay on STARTER and add packs of 5 machines at 99 PLN net per month (≈ €25), up to three. PRO starts at 26 machines and BUSINESS at 51.

Machines	Plan	Monthly net subscription	Monthly cost per machine
9	STARTER	≈ €49	≈ €5.44
10	STARTER	≈ €49	≈ €4.90
11	STARTER + 1 pack	≈ €74	≈ €6.73
15	STARTER + 1 pack	≈ €74	≈ €4.93
16	STARTER + 2 packs	≈ €99	≈ €6.19
25	STARTER + 3 packs	≈ €124	≈ €4.96
26	PRO	≈ €149	≈ €5.73
50	PRO	≈ €149	≈ €2.98
51	BUSINESS	≈ €499	≈ €9.78
200	BUSINESS	≈ €499	≈ €2.50

These are plan prices, not forecasts of labour costs. Cost per machine changes in steps when the plan changes. Annual prices are approximately €490 for STARTER (€740, €990 or €1,240 with packs), €1,490 for PRO and €4,990 for BUSINESS. The online purchase option is for companies in Poland and is charged in PLN. The euro amounts are approximate references, shown with “≈”.

The calculator should show both monthly and annual amounts using the actual annual fee. Do not compare a yearly subscription with one month of your own labour. Compare the same period on both sides. Above 200 machines, ask for an individual quote instead of extending this table.

Two example scenarios

Positive example, illustrative only. Suppose there are 10 servers, 30 hours of work a month and an example rate of €35 per hour. This is not a market rate or recommendation. Manual work costs 30 × €35, or €1,050 monthly. If 2 hours of work remain after adoption, the service scenario is 2 × €35 + approximately €49 for the subscription, or about €119. The estimated difference is about €931 per month. This is an example, not a customer measurement or a forecast for your organisation. Replace the hours and rate with your own numbers.

Negative example, also illustrative. For nine machines, suppose manual work takes one hour and one hour of work remains after adoption, using the same example rate of €35. Today's labour costs €35; the service scenario is €35 plus approximately €49, or about €84. In this calculation the subscription adds approximately €49 per month. That is a valid result for those assumptions. Do not change it by inventing extra hours or assigning an arbitrary value to incident risk.

These examples do not describe customers or predict your organisation's result. The €35 rate only demonstrates the multiplication and is a placeholder example. Replace it with your own rate. If a small change in hours changes the sign, that is useful information: measure the process more carefully before deciding.

When the result is negative

A negative result means that, under your assumptions, the estimated service and remaining labour cost more than the current manual work. It should remain visible. It does not have to decide the purchase by itself. Price is one part of a decision about how work is managed.

You may also consider a prioritised task list for administrators, a management report or material supporting evidence preparation. Assess those benefits separately against your process. The calculator does not price them or turn them into hypothetical euros. It does not estimate incident costs, penalties or regulatory compliance.

Check how sensitive the result is: change remaining hours, your rate and fleet size. Ask whether the hours include only recurring collection and assembly. If you counted patching, application testing or risk acceptance meetings, the two sides no longer describe the same scope.

What this calculation does not cover

The result excludes deployment, integration maintenance, in-depth analysis of individual vulnerabilities (for example, checking an exploit against a specific application), remediation and downtime. It does not value incident risk or say whether an organisation complies with NIS2 or ISO 27001. In Poland, KSC is the national law implementing NIS2. Secvalis supports vulnerability management and evidence preparation for Linux servers; it does not replace administrator decisions or risk ownership.

Treat the calculator as a basis for an internal discussion, not an audit report. Keep your assumptions beside the result, date them and revisit them after a few measurement cycles. You will then know whether H and Hs match the real process. Start with the calculator below and enter your own values.

Need help with deployment? Contact me at https://sysdevops.eu/kontakt. We will agree the scope, confidentiality and formal arrangements individually.