Patch SLA vs vulnerability metrics — how are others reporting this to governance forums?

I'm interested in how others are handling patching metrics. I currently report patching using: % endpoints missing critical/important patches outside a 14-day SLA (aligned to UK Cyber Essentials), and total high/critical vulnerabilities aged >14 days. The idea was to show both patching covera