You are a security administrator using Microsoft Defender for Endpoint. Leadership asks you to report on how susceptible your organization's onboarded devices are to active threats and vulnerabilities based on current device configuration and unpatched CVEs. They specifically want a single metric that reflects the organization's device threat exposure, where a lower value is better. Which Defender Vulnerability Management metric should you report?