There is no universal number of suppressions that is too many. Judge the list by its health: the share of findings suppressed, how old entries are, how many have expired or lost their owner, and how often they are renewed. A growing, aging list with no reviews is the warning sign.
Why a raw count misleads
Fifty suppressions across two hundred repositories may be fine. Fifty in one repository is a smell. And a team with zero suppressions is not automatically healthy: it may simply never triage, or it may fix everything the day it appears, which is rare.
Count matters less than movement and quality.
Six signals worth tracking
| Signal | How to read it |
|---|---|
| Suppressed share of all findings | A rising share over several months means triage is turning into hiding |
| Median age of active suppressions | Old medians mean nobody is reviewing |
| Expired but still silencing | Should be zero. Any value means the tool is not enforcing end dates |
| Entries with no owner | Orphans that nobody can renew or remove |
| Renewal count per entry | Repeated renewals mean the real fix keeps slipping |
| Entries for packages no longer in the SBOM | Dead weight to delete |
None of these needs fancy analytics. A weekly export and a spreadsheet is enough to begin.
Rough thresholds that start a conversation
These are conversation starters, not standards:
- More than a quarter of high severity findings suppressed.
- Any entry older than the policy maximum.
- More than one renewal on a high severity entry.
- More than a handful of entries whose package no longer exists in the build.
Set your own after a month of looking at your data.
What to do when the signals turn red
- Delete dead entries. Compare the list to the current SBOM and remove entries for absent components.
- Clear orphans. Assign each to an owner or let it expire.
- Convert repeats into work. An entry renewed twice becomes a ticket with a date.
- Slow the intake. Add the review checklist from our post on reviewing suppression diffs.
Our article on exception metrics goes further on aging and coverage.
Tell the right story to leadership
Leaders hear "we suppressed 300 findings" and worry. Pair every count with its reasons: how many are not present, how many not reachable, how many deferred with dates. A list that is mostly evidence backed not reachable entries tells a good story. A list that is mostly deferrals tells you where the backlog is.
Try it yourself
Click through it at your own pace, or open it full screen. Notice how findings are grouped by status, which is the view you need to see the suppressed share at a glance.
Start small
If you have never measured, export the list today and answer three questions: how many entries, how many are past their end date, and how many have no owner. Those three numbers alone usually reveal where to begin.
Quick check
What is a healthy suppressed share?
No single figure fits everyone. Watch the trend and the reasons. A steady share backed by evidence is fine.
How often should the list be reviewed?
Monthly for most teams, weekly for high severity entries.
Last reviewed: 19 October 2026.
