diff --git a/src/main/java/com/hiveops/aria/controller/ThreatEventController.java b/src/main/java/com/hiveops/aria/controller/ThreatEventController.java
index 605d8dd..9a65b75 100644
--- a/src/main/java/com/hiveops/aria/controller/ThreatEventController.java
+++ b/src/main/java/com/hiveops/aria/controller/ThreatEventController.java
@@ -10,12 +10,12 @@ import lombok.RequiredArgsConstructor;
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.PageRequest;
 import org.springframework.data.domain.Sort;
+
+
 import org.springframework.http.ResponseEntity;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 
-import java.time.Instant;
-import java.time.temporal.ChronoUnit;
 import java.util.Map;
 
 @RestController
@@ -50,16 +50,9 @@ public class ThreatEventController {
     @GetMapping("/stats")
     @PreAuthorize("hasAnyRole('MSP_ADMIN','BCOS_ADMIN')")
     public ResponseEntity<Map<String, Object>> getStats() {
-        Instant since24h = Instant.now().minus(24, ChronoUnit.HOURS);
-        Instant since7d  = Instant.now().minus(7, ChronoUnit.DAYS);
-
         long totalEvents   = eventRepository.count();
-        long critical24h   = eventRepository.findBySeverityOrderByDetectedAtDesc(
-                ThreatEvent.ThreatSeverity.CRITICAL,
-                PageRequest.of(0, Integer.MAX_VALUE)).getTotalElements();
-        long high24h       = eventRepository.findBySeverityOrderByDetectedAtDesc(
-                ThreatEvent.ThreatSeverity.HIGH,
-                PageRequest.of(0, Integer.MAX_VALUE)).getTotalElements();
+        long critical24h   = eventRepository.countBySeverityNative("CRITICAL");
+        long high24h       = eventRepository.countBySeverityNative("HIGH");
         long activeIocs    = iocRepository.findByActiveTrue().size();
 
         long activeSequences = sequenceAlertRepository.countByResolvedAtIsNull();
diff --git a/src/main/java/com/hiveops/aria/repository/ThreatEventRepository.java b/src/main/java/com/hiveops/aria/repository/ThreatEventRepository.java
index a75e70c..5d0f723 100644
--- a/src/main/java/com/hiveops/aria/repository/ThreatEventRepository.java
+++ b/src/main/java/com/hiveops/aria/repository/ThreatEventRepository.java
@@ -4,6 +4,8 @@ import com.hiveops.aria.entity.ThreatEvent;
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.Pageable;
 import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.query.Param;
 import org.springframework.stereotype.Repository;
 
 import java.time.Instant;
@@ -22,5 +24,8 @@ public interface ThreatEventRepository extends JpaRepository<ThreatEvent, Long>
 
     Page<ThreatEvent> findBySeverityOrderByDetectedAtDesc(ThreatEvent.ThreatSeverity severity, Pageable pageable);
 
+    @Query(value = "SELECT COUNT(*) FROM threat_event WHERE severity = CAST(:severity AS threat_severity)", nativeQuery = true)
+    long countBySeverityNative(@Param("severity") String severity);
+
     Page<ThreatEvent> findAllByOrderByDetectedAtDesc(Pageable pageable);
 }