Measure a gate with five numbers: how often it blocks, how often people override it, how long a blocked developer waits, how many vulnerabilities reach production anyway, and how old your exemptions are. Together they show whether the gate protects or just annoys.
The five metrics
| Metric | How to compute | Healthy sign | Warning sign |
|---|---|---|---|
| Block rate | Blocked builds divided by gated builds | Low and stable | Spikes after rule changes |
| Override rate | Bypasses and exemptions divided by blocks | Small and falling | Rising, or concentrated in one team |
| Time to unblock | Block time to next green build | Hours | Days |
| Escaped findings | Findings in production that the gate should have caught | Near zero | Growing |
| Exemption age | Days since each active exemption was granted | Under expiry | Past expiry |
Why each one matters
Block rate alone is misleading. A zero block rate may mean a clean codebase or a gate that does nothing. Pair it with the seeded test: a deliberate vulnerable pull request that should fail. If that passes, the block rate means nothing.
Override rate shows trust. When developers route around a gate, they are telling you something about its accuracy or its cost. Look at which rules are overridden most, and fix or retire them.
Time to unblock is the cost side. A gate that blocks for a day for each finding taxes delivery. Many teams improve this by putting the fix suggestion in the failure message.
Escaped findings test effectiveness. Compare the production inventory against your gate rules. If vulnerable code reached production, find out why: a gap in scope, an exemption, a bypass, or a late advisory.
Exemption age is hygiene. An exemption past expiry is a control that quietly stopped working.
Steps to start tracking
- Log every gate result with repository, rule and outcome.
- Log every exemption and bypass with dates and reasons.
- Build a monthly report with the five numbers.
- Review it with engineering leads, not just security.
- Pick one metric to improve per quarter.
Avoid vanity numbers
The count of vulnerabilities found is not a measure of the gate. More findings can mean better detection or a worse codebase. Focus on outcomes: fewer escapes, fewer overrides, faster unblocks.
Report to leadership carefully
Show trends, not single months. Explain changes in plain terms, such as "we widened the threshold in March, so blocks rose and then fell as the backlog cleared".
Quick check
What is a reasonable target for time to unblock?
There is no universal number. Aim for the same working day, and investigate anything longer.
Is a zero block rate good news?
Only if a seeded test still fails the gate. Otherwise it may be silent.
Safeguard's compliance and evidence automation can collect gate results and exceptions into a report for reviewers. A free scan is at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
