The BEST key performance indicator (KPI) to measure the effectiveness of a vulnerability remediation program is the number of: