Explain an SCA report to executives with five numbers: how much of the estate was scanned, how many findings are known exploited, how many are reachable in production code, how old the oldest open item is, and whether the trend is improving. Skip raw totals and severity histograms, which invite the wrong questions.
Why executives need fewer numbers
An executive wants to decide something: fund a fix, accept a risk, or move on. A 200 row table does not support any of those. Five numbers with one sentence each do.
The five numbers
| Number | Plain wording | Why it matters |
|---|---|---|
| Coverage | "We scanned 38 of 40 production services" | Shows what you cannot yet see |
| Known exploited | "2 open findings are on CISA's exploited list" | Attackers are already using these |
| Reachable in production | "9 findings are in code that runs and can be called" | The real exposure |
| Oldest open item | "The oldest has been open 74 days" | Shows whether fixes stall |
| Trend | "Down from 15 reachable findings last month" | Shows direction |
The figures in the table are placeholders to show wording, not data from any real report.
Where the definitions come from
CISA describes its Known Exploited Vulnerabilities catalog as listing vulnerabilities that have an assigned CVE ID, reliable evidence of active exploitation in the wild, and a clear remediation action. That is a solid, citable definition for the second number.
For the third number, explain reachability simply: the vulnerable package is in the product, and the vulnerable function can be called by the product's code. FIRST states that CVSS Base Score alone represents only intrinsic characteristics of a vulnerability and should be supplemented by contextual analysis, which is a reasonable one line reason you lead with exposure instead of severity.
Wording tips
- Lead with the decision you need, then the numbers.
- Use plain words. Say "known to be attacked" instead of a catalog name if the audience does not know it.
- Say what you do not know. A coverage gap stated plainly builds trust.
- Avoid percentages with no denominator.
- Do not compare to other companies unless you have a sourced benchmark.
A sample paragraph
"We scanned 38 of 40 production services. Two open findings are known to be exploited by attackers and both have fixes scheduled this week. Nine findings are in code we run and can be called. The oldest open item is 74 days old and has an owner. Reachable findings fell from 15 last month. We need one engineer for two weeks to clear the two services we cannot yet scan."
The numbers in that paragraph are illustrative only.
Try it yourself
Click through it at your own pace, or open it full screen. See which summary views you could lift into an executive update.
Where Safeguard fits
Safeguard's vulnerability management and compliance reporting surface exploit signals and reachability next to coverage, which supports this kind of summary.
Quick check
Should executives see severity counts?
They can, but as context. Lead with exploited and reachable findings, since those drive decisions.
What if coverage is low?
Say so first. A low coverage number is a finding in itself and often the best use of a request for resources.
Sources
Last reviewed: 19 October 2026.
