Lead with coverage, then show the few findings that matter most, then give a plan with owners and dates. Avoid opening with a raw total of findings. A large number without context invites panic or dismissal, and neither helps you get the work done.
What leaders want to know
Three things: how bad is it, what are we doing, and what do you need from us. Your report should answer them in that order, on one page, with a table and a short paragraph.
A structure that works
1. Coverage
State what was scanned and what was not. Use plain counts from your own census: directories found, directories scanned, directories with exact versions, and known gaps. Say what you could not see, because leaders trust reports that admit limits.
2. Exposure
Show findings in internet facing services, split by whether the vulnerable code is reachable and whether a fix exists. Keep it to a small table.
| Group | Meaning | Next step |
|---|---|---|
| Exposed, reachable, fix available | Highest priority | Fix this sprint |
| Exposed, reachable, no fix | Needs a mitigation | Owner and date |
| Exposed, reachability unknown | Needs review | Developer check |
| Internal or unreachable | Tracked in baseline | Revisit quarterly |
3. The baseline
Explain that existing findings are recorded with a date, and that the new rule is to stop adding more. This is the most useful message for leaders: the problem will not grow while you work it down.
4. The plan
Name the owners, the first twenty items, and the date you will report again. Add the 90 day phases if you have them.
5. The ask
Be specific. Ownership for unclaimed directories, time from two teams, a decision on an exception. Vague asks get vague answers.
What to leave out
- Raw totals with no grouping.
- Severity pie charts. They show a distribution, not a decision.
- Tool names and screenshots of dashboards. Describe the findings in your own words.
- Predictions you cannot support, such as a date by which the repository will be clean.
Be careful with comparisons
Do not compare the first scan with a previous period unless you scanned the same way. Before onboarding, you had no number, so there is no trend yet. Start the trend line now and say so.
Follow up
Send the same one page every two weeks for the first quarter. Keep the layout identical so changes stand out. When something slips, say it early and say why.
Where Safeguard fits
Safeguard's compliance and evidence automation and its vulnerability tracking can supply the numbers for each section, and a free scan at https://gold.safeguard.sh/scan gives a first look at a single project.
Try it yourself
Click through it at your own pace, or open it full screen.
Look for the grouping and status views, and think about which would fit on your one page.
Quick check
Should we share the full list of findings with leadership?
Offer it as an appendix, but do not lead with it. The one page report is the decision document.
How do we show progress if the baseline is large?
Track new findings introduced, the first twenty closed, coverage gained and time to assign an owner.
Last reviewed: 19 October 2026.
