Track a few leading metrics (are champions active, is their time protected) and a few lagging ones (do repeat findings and time to fix drop). Report trends per team, not league tables of individuals. If a number can be gamed without improving security, drop it.
Leading and lagging, defined
Leading metrics show whether the activity is happening. They move early and tell you if the program is alive. Lagging metrics show whether risk is changing. They move slowly and take months to read.
The table
| Metric | Type | How to count it | Caution |
|---|---|---|---|
| Teams with a named champion | Leading | Teams covered divided by teams in scope | A name is not activity |
| Protected time actually used | Leading | Hours logged or calendar blocks kept | Do not use it to police people |
| Findings triaged within an agreed time | Leading | Share of new findings with a champion decision | Set a realistic window |
| Briefing attendance | Leading | Champions present per session | Attendance is not learning |
| Repeat finding rate | Lagging | Same flaw class returning in the same team | Needs a stable taxonomy |
| Time to fix by severity | Lagging | Median days from open to closed | Watch for downgrading severity |
| Security issues found in review, not production | Lagging | Count caught before merge versus after release | Depends on reporting habits |
| Champion retention | Lagging | Share still active after 12 months | Low retention points to workload |
OWASP SAMM describes quality criteria for champion activity, including champion training and regular briefings, but gives no list of numeric targets on the pages we read. Pick targets from your own baseline.
Set a baseline first
Before launch, capture three numbers for each team: open findings by severity, median fix time, and the three most common flaw classes. Re-measure every quarter. Without a baseline you will be arguing from impressions.
Avoid these traps
- Counting quiz scores as security outcomes.
- Ranking people or teams publicly. It encourages hiding findings.
- Reporting fewer vulnerabilities as success when you simply scanned less.
- Mixing severity scales between tools.
- Declaring victory after one quarter. Lagging numbers need time.
What to report to your sponsor
One page each quarter: coverage, activity, trend in repeat findings, trend in fix time, one story of a catch, and one request. Keep the request concrete, such as protecting time for two more teams.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how open findings and their status can be tracked over time, which is the raw material for fix time and repeat finding counts.
Where Safeguard fits
Safeguard provides vulnerability scanning and compliance evidence automation, which can supply the finding and fix time data behind these metrics. You can try a free scan.
Quick check
How soon should we expect lagging metrics to move?
Plan on at least two to three quarters. Early quarters mostly tell you whether the activity is happening.
Should champions see their own metrics?
Yes, at team level. Use the data to help them ask for support, not to rank them.
Sources
Last reviewed: 19 October 2026.
