Vulnerability backlog

When new findings permanently outpace fixes, the backlog stops being a queue and becomes a permanent condition.

Nothing is ever cleared, so the number only means something as a trend. At that point the useful question changes from "how do we get to zero" to "are the right things being fixed", because the answer to the first is no. Organisations that keep reporting the total are measuring the scanner's productivity rather than their own.