Your vulnerability backlog is not one number. It is at least nine. Here are the three segmentations that make it a usable security metric.