A security analyst is preparing the monthly vulnerability management report for the CISO and IT operations leadership. Leadership has stated that raw vulnerability counts are not useful because the environment is constantly growing, and they want to understand whether the remediation program is actually becoming more effective over time. Which metric should the analyst emphasize to best answer leadership's concern?