Report the median time to remediate as the headline, because a few very old findings can drag the mean far from what most fixes look like. Then show how many items are past their SLA and the age of the oldest open one. Together those three numbers tell the real story.
What each number means
The mean adds every remediation time and divides by the count. The median is the middle value when you sort them. If most findings close quickly and a handful sit for months, the mean rises sharply while the median barely moves.
Neither is wrong. They answer different questions. The median says what a typical fix looks like. The mean says how much total delay the program carries per finding, long tail included.
| Measure | Answers | Weakness |
|---|---|---|
| Median | How long does a typical fix take? | Ignores the worst items entirely |
| Mean | How much delay does the average finding carry? | One ancient item can distort it |
| Share past SLA | How much of the work is late? | Depends on the SLA being sensible |
| Age of oldest open | What is our worst case? | One number, easy to over read |
Why executives get misled by the mean
Suppose a quarter looks healthy because the team closed many findings quickly, yet one stubborn item from last year is still open. The mean time to remediate goes up and a leader may conclude the team slowed down. The opposite also happens: closing a pile of old items in one push makes the mean spike in the month they close, because their long ages enter the calculation at that moment.
That second effect is why a cleanup sprint can make a chart look worse before it looks better. Tell people before they see it.
A reporting recipe
- Compute remediation time only for findings that closed in the period, from the start of your SLA clock to the fix reaching production.
- Report the median, split by severity or by your priority tier. Do not blend tiers into one figure.
- Report the count and percentage of open items past SLA, with the count first. See the denominator problem.
- Report the age of the oldest open item and name its owner and reason in a sentence.
- Keep the mean in the engineer view only, where the long tail is something people can act on.
If you need percentiles, the 90th percentile gives a middle path: it shows how long the slower tenth of fixes takes without letting a single outlier dominate.
For engineers versus for executives
Engineers want to find the stuck items, so a sorted list of the oldest findings is more useful than any average. Executives want a trend and a risk statement, so one median line per tier plus the past SLA count is plenty. For related definitions see the metric definition card template.
Safeguard can supply the per finding data behind this view through SBOM and dependency scanning, reachability analysis and policies that gate builds. You can try a free scan on one of your own repositories to see the fields.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how findings age in the queue, then ask which of the four numbers above would show that clearly.
Quick check
Should the SLA clock start at disclosure or at detection?
Pick one and write it down. Many teams start at the moment the finding is triaged as valid for them, others at public disclosure. Mixing the two across teams makes comparisons meaningless.
Can I report only the median?
You can, but pair it with the past SLA count, otherwise a median can look fine while a serious backlog grows.
Last reviewed: 19 October 2026.
