In the first year, track four things: how much of your software is covered by automated checks, how old your severe findings are, whether new findings outpace closed ones, and how fast you fix actively exploited issues. Skip vanity totals. A short, steady set of numbers beats a large dashboard.
What makes a good metric
A good metric changes someone's behavior, can be gathered without heroics, and is hard to game. Counts of total findings fail the test. They rise when you scan more, which is progress, and fall when you stop looking, which is not.
Starter set
| Metric | What it tells you | Watch out for |
|---|---|---|
| Coverage of repositories with scanning | How much you can see | Count only repositories you actually own |
| Age of open severe findings | Whether fixes happen | Age only counts if severity is trusted |
| New versus closed per week | Whether debt grows | Needs steady scanning |
| Time to fix known exploited issues | Response to real threats | Define the clock start |
For the last one, CISA's Known Exploited Vulnerabilities catalog is a reasonable list to match against, and CISA advises using it as an input to vulnerability prioritization.
Add later
- False positive rate of each check, from developer feedback.
- Exception count and age.
- Training or champion participation.
- Share of releases that went through a design review.
OWASP SAMM includes a Strategy and Metrics practice and scores it as part of Governance, which is a good prompt to think of metrics as a program activity, not a report.
Reporting rules
- Show trends, not snapshots.
- Pair each number with a decision it supports.
- Report by team so owners see their own data.
- Mark changes in method, so a jump is not misread.
- Show bad news early and plainly.
Quick check
Should we track the number of vulnerabilities found?
Only as context. It is a poor target because it rises with better coverage.
How often should we report?
Monthly for teams, quarterly for leadership. More often creates noise.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at the status views. Pick which of them map onto the four starter metrics above.
Safeguard's continuous monitoring and dashboards cover findings and their ageing, and its compliance and evidence automation keeps records for audits. Try a free scan.
Sources
- CISA Known Exploited Vulnerabilities Catalog (cisa.gov). Paraphrased.
- OWASP SAMM model page (practice names). Paraphrased.
Last reviewed: 19 October 2026.
