Fix-rate is the share of security findings that teams actually repair, usually expressed as a percentage of total alerts or discovered issues. It is an operational metric, not just a counting metric: a scanner that finds many flaws but leaves most unresolved may be less useful than one that helps teams close more issues quickly.
In cyber security, fix-rate matters because attackers benefit from any weakness that survives triage and remediation. Defenders use it to judge whether a tool, workflow, or security program is creating real risk reduction. In static application security testing, for example, fix-rate can be more meaningful than raw alert volume because it reflects developer trust, triage speed, and how well findings fit into CI/CD and code review workflows. A high fix-rate often indicates clear findings, good prioritization, and low-friction remediation; a low fix-rate can signal noisy alerts, poor ownership, or slow handoffs between security and engineering.