Check the flow, not just the stock. A backlog falls when closures exceed new findings, but it also falls when items are bulk closed as accepted, deduplicated or auto expired. Chart findings opened and closed per period, and split closures by reason, to know whether you are fixing or only tidying.
Stock versus flow
The backlog is a stock: how many are open now. Opened and closed per week are flows. A stock chart alone cannot say why it moved.
| What you see | Possible meanings |
|---|---|
| Backlog down | Fixes outpaced inflow, or a bulk closure, or scanning slowed |
| Backlog flat | Balanced, or both flows are tiny |
| Backlog up | Inflow rose, or fixing slowed, or scanning widened |
Each row has a good reading and a bad one. The flows tell you which.
Break closures into reasons
Not all closed items are equal. Use a small fixed set of closure reasons:
- Fixed in code or dependency.
- Mitigated by configuration or control.
- Not affected, such as the vulnerable code is not reachable.
- Accepted risk, with owner and expiry.
- Duplicate or merged.
- Asset retired.
- Auto closed by age or rule.
A healthy trend has "fixed" and "not affected with evidence" as the bulk. A trend driven by "accepted" or "auto closed" is housekeeping, and sometimes a warning.
Add the age profile
Count open items by age band, for example under 30 days, 30 to 90, over 90. A backlog that falls in the young bands and grows in the old band is accumulating a hard residue. A stock number cannot show that, and an average hides it.
Steps to build the view
- Define opened as the first time your tooling reports a finding, and keep that rule fixed.
- Record a closure reason on every closed item. Make it mandatory.
- Chart opened and closed per week as paired bars, with the stock as a line.
- Add age bands for open items.
- Annotate scanner, rule and scope changes, since they move inflow.
- Review any week where closures spike for the reason mix before celebrating.
Why spikes deserve a question
A one week drop of many items is a signal to look, not a win to report. It might be a sensible cleanup after reachability triage, which is legitimate if the reason is evidence based. It might be a blanket acceptance. The reason field separates the two.
What to report upward
Report net flow (opened minus closed), share of closures that are fixes, and the count of items older than the response window. Those three numbers resist most gaming because each cheat shows up in another.
Safeguard offers SBOM and dependency scanning, reachability analysis and policy gates. You can run a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how findings with an available fix are surfaced, since those are the closures that count as real fixes.
Quick check
Is a shrinking backlog always good news?
No. Check closure reasons and whether inflow dropped because scanning narrowed.
How often should we review opened versus closed?
Weekly is a common rhythm for the chart, with a monthly look at the age bands.
Last reviewed: 19 October 2026.
