Asset coverage is assets scanned divided by assets that should be scanned, and the hard part is the denominator. If the list of assets comes from the same tool that does the scanning, unknown assets never appear, so coverage looks high by construction. Build the denominator from independent sources.
The circular denominator
Many dashboards compute coverage as scanned assets over assets known to the scanner. Anything the scanner has never heard of is absent from both numbers. A repository created last week in a team account, a container image built outside the normal pipeline, a forgotten cloud project: all invisible. The figure can reach one hundred percent while the real estate is much larger.
Independent sources for the denominator
Gather lists from places that do not depend on the scanner:
- Source control organisations, listing every repository.
- Cloud account inventories and container registries.
- Package registries your company publishes to.
- Identity provider or single sign on application lists, for services.
- Finance records of cloud accounts and subscriptions, which often reveal projects nobody listed.
- Build system job lists.
Merge them, remove duplicates by a stable identifier, and mark each item with an owner and an in scope status. The merged list is your denominator.
Handle exclusions openly
Some items are legitimately out of scope: archived repositories, forks, sandboxes. Give each exclusion a reason and a date, and report the excluded count. A coverage figure with a hidden exclusion list is a figure that cannot be challenged or trusted.
Report three numbers, not one
| Figure | Meaning |
|---|---|
| Known assets scanned | Coverage of what you already track |
| Known assets total | The merged denominator |
| Suspected unknown | Items seen in one source but missing from the merged list |
The third row is the useful one. Each item in it is either a gap in the inventory or a source with noise, and both are worth knowing.
Define scanned
An asset counts as scanned only if a complete, successful scan finished inside the freshness window you set. A scan from last year does not count. Pair this with a scan freshness view, as described in what scan freshness is.
A lightweight monthly routine
Once a month, export the repository list and the registry list, diff them against the asset inventory, and review the differences with team leads. The goal is a short list of new items, each assigned or excluded with a reason. After a few cycles, the unknown count becomes a trend you can report.
Safeguard does this kind of counting in one place: SBOM and dependency scanning, asset discovery and reachability analysis feed the same inventory, so each number can be traced back to its source. Asset discovery lists what exists so the denominator does not depend on a single scanner's view. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Can coverage ever be exactly one hundred percent?
On a known list, yes. Against the true estate, treat it with suspicion until the denominator comes from independent sources.
Should archived repositories count?
Only if they still deploy or hold live dependencies. Otherwise exclude them with a recorded reason.
Last reviewed: 19 October 2026.
