Give leadership one page with four lines: what each number counts, why they differ, the confirmed number after reconciliation, and what you will do next. Do not pick the smaller number to look better or the larger to look cautious. Show the method so the figure can be repeated.
Why this conversation happens
Executives see a dashboard with 412 findings from one tool and 96 from another and ask which one is true. The honest answer is usually that both are accurate descriptions of different things. Your job is to say which things.
The four line page
1. What each number counts. Name the unit, the scope and the input. For example: Tool A counts each package and advisory pair across all scopes in the manifest. Tool B counts distinct advisories on the lockfile, excluding test dependencies.
2. Why they differ. Use causes, with a rough split if you have measured it.
| Cause | Share of gap |
|---|---|
| Different counting unit | Estimate from your sample |
| Different scope | Estimate from your sample |
| Different advisory data or timing | Estimate from your sample |
| Real coverage difference | Estimate from your sample |
Fill the table from a reviewed sample, not from guesses. If you have not sampled, say so and give a date for when you will.
3. The confirmed number. After reconciliation, state how many distinct advisories affect shipped software, how many are reachable if you measure that, and how many have a fix available. This is the number to track.
4. Next steps. Name the owner, the date, and the policy decision you need from leadership, if any.
Wording that helps
- Say "counts different things" instead of "one tool is wrong."
- Say "we confirmed" only for items someone has verified against an advisory.
- Say "we have not yet verified" for the rest.
- Avoid ratios between the two raw totals. They invite the wrong conclusion.
What to leave out
Do not ship screenshots of both dashboards without an explanation. Do not claim a percentage of false positives unless you counted them on a defined sample. Do not promise a zero. A zero means a tool found nothing, not that nothing exists.
Keep the trend honest
Choose one unit and one scope for the trend line, and write them under the chart. If you ever switch tools or change scope, mark the change on the chart and, if possible, restate the old numbers on the new basis. A line that falls because the counting changed will not survive the first follow up question.
A short script for the meeting
"The two totals measure different things. After aligning scope and unit, we reviewed a sample of thirty items. The confirmed number of distinct advisories affecting shipped software is on the page, with the owner and the date for the next review."
That is enough for most executive conversations. If someone wants detail, you have the reconciliation file behind it.
Try it yourself
Click through it at your own pace, or open it full screen. Notice which numbers the view shows together, since a report works best when counts, status and ownership appear side by side.
Quick check
Should I show leadership both raw totals?
Show them, but beside a plain statement of what each counts, and lead with the confirmed number.
What if I cannot reconcile in time?
Say so. Present the raw totals with their units, name the owner and give a date. An honest gap beats a guessed figure.
Last reviewed: 19 October 2026.
