Lagging indicators, such as time to fix and incidents, tell you what already happened. Leading indicators, such as scan coverage, ownership coverage and the share of new code passing a gate, change earlier and warn you before results slip. A good report pairs one of each.
Definitions
A lagging indicator measures an outcome after the fact. It is reliable, but it arrives late.
A leading indicator measures a condition that tends to precede an outcome. It arrives early, but the link to the outcome is a judgment, not a guarantee.
Examples in vulnerability management
| Indicator | Type | What it tells you |
|---|---|---|
| Median time to remediate | Lagging | How fast fixes reached production |
| Open items past SLA | Lagging | How much work is already late |
| Incidents tied to known vulnerabilities | Lagging | Whether gaps were exploited |
| Scan coverage | Leading | Whether you can see the problem |
| Ownership coverage | Leading | Whether findings will be acted on |
| Share of pull requests that pass the gate on first run | Leading | Whether new risk is entering |
| Dependency update lag | Leading | How exposed you will be to the next advisory |
| Expiring exceptions in the next period | Leading | Future items about to reopen |
See dependency update lag as an exposure metric.
Why you need both
If you only watch lagging indicators you will learn about a problem after the quarter is over. If you only watch leading indicators you may optimize conditions that do not change outcomes. Together they let you say "coverage dropped, so we expect inflow of unseen findings, and past SLA counts will rise next month unless we act."
Steps to pick a pair
- Choose the outcome you care about, such as time to fix for priority one items.
- List conditions that influence it, such as ownership, coverage, upgrade lag.
- Choose one that you can measure reliably and quickly.
- Chart the two together over several months.
- Check whether the leading one has actually predicted the outcome. If not, replace it.
Do the check. Many teams assume a leading indicator works and never test it.
How to show it to executives
Use a two line chart or a small table: this month's leading indicator value and direction, and the lagging value it is expected to affect. Add one sentence: "ownership coverage rose, which should reduce past SLA items next quarter." Say "should", not "will", unless you have evidence.
Cautions
- A leading indicator turned into a target can be gamed, for instance by scanning trivially small repositories to raise coverage
- A lagging indicator with a tiny sample is noisy. See small numbers and noise versus signal
Safeguard's policies and gates on pull requests produce the first pass share, and its scanning and asset discovery support coverage figures. Try the free scan on one repository.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch what the gate checks on a pull request and note which leading indicator it would feed.
Quick check
Is MTTR leading or lagging?
Lagging. It reports how long past fixes took.
How many indicators should an executive report show?
A small set, for example one or two of each type, with a sentence connecting them.
Last reviewed: 19 October 2026.
