Describe the backlog as a queue with a carrying cost: items age, each one adds rework and exposure, and a small share drives most of the risk. Bring the CFO a choice with ranges you can defend, not a single dramatic number, and never invent figures to make the case.
Think in queues
A CFO already understands inventory, receivables and technical debt. A vulnerability backlog resembles an ageing receivable: the longer it sits, the harder it is to resolve. Items get older, the context fades, the people who wrote the code move on, and upgrades get larger because dependencies drift further.
The cost components
| Component | What it is | How to estimate honestly |
|---|---|---|
| Engineering time | Hours to fix each item now versus later | Use your own tracked time from recent fixes |
| Rework from drift | Bigger upgrades as versions fall behind | Compare past small upgrades to past large ones |
| Interruption cost | Unplanned work when an item turns urgent | Count recent urgent interruptions and their duration |
| Sales friction | Deals slowed by questionnaires or findings | Ask sales for specific examples |
| Exposure | Chance and impact of an incident | State as scenarios, not predictions |
Use your own data. Do not borrow industry statistics unless you have read the source and can cite it.
Reduce the pile with reachability
Not all items are equal. Reachability analysis checks whether your code can call the vulnerable part of a library, which tends to shrink the urgent set. The CFO conversation changes from "we have 1,200 findings" to "of 1,200 findings, a small number need work now, and the rest are scheduled."
Prioritise with evidence
CISA's catalog of vulnerabilities known to be exploited in the wild is an input CISA recommends for prioritization (CISA). FIRST notes CVSS should not be used alone to assess risk (FIRST). Together with exposure data, these let you show that spend goes where it reduces the most risk.
The decision to put in front of the CFO
Offer three options.
- Keep the current pace. State what that implies about queue age in six months.
- Add a fixed share of capacity per sprint to the oldest and most exposed items.
- Fund automation for routine upgrades so people work on the hard ones.
For each, state the cost in time and the effect on the metrics in the monthly report (see the metrics list).
What not to do
- Do not quote a large figure for the cost of a breach unless you can show where it came from.
- Do not present total findings as if each were equal.
- Do not promise zero. Offer a queue that stays within an agreed age.
Make it recurring
Report the same three numbers each quarter: oldest age, items past target, and engineering time spent. A CFO trusts a stable view more than a single persuasive slide.
Try it yourself
Click through it at your own pace, or open it full screen. Watch the urgent set shrink once reachability is applied. That reduced set is the one worth costing.
Where Safeguard fits
Safeguard offers dependency scanning, reachability analysis and fix pull requests (off by default, every category on Manual), which support options two and three. The free scan is at gold.safeguard.sh/scan.
Quick check
Should we put a breach cost on the slide?
Only if you can cite where the number came from and what it assumes. Otherwise describe scenarios in words.
What single number helps a CFO most?
The age of the oldest high-exposure item, tracked over time.
Sources
Last reviewed: 19 October 2026.
