Track report count, valid report count, median age of open valid reports, reports older than 90 days, and median time to first response, validation and remediation. Those are the metrics CISA asked federal agencies to report. They measure how your process behaves, not how many bugs people find.
The list from CISA
BOD 20-01 requires federal agencies to report a defined set of metrics after a transition period. They are:
- number of vulnerability disclosure reports
- number of reported vulnerabilities determined to be valid, meaning in scope and not a false positive
- number of currently open and valid reported vulnerabilities
- median age, in days from receipt, of currently open and valid reports
- number of currently open and valid reports older than 90 days
- number of all reports older than 90 days by risk or priority level
- median age of reports older than 90 days
- median time to validate a submitted report
- median time to remediate or mitigate a valid report
- median time to initially respond to the reporter
A private company is not bound by that directive. It is still a tested starting list.
Reading each number
| Metric | What it tells you | Warning sign |
|---|---|---|
| Reports received | Demand and clarity of your policy | Sudden spike after a launch or post |
| Valid reports | Signal quality | Very low share suggests noisy scope |
| Median time to first response | Whether people feel heard | Over a few business days |
| Median time to validate | Triage capacity | Growing queue |
| Median time to remediate | Engineering throughput | Few fixes landing |
| Open valid reports past 90 days | Backlog risk | Any, especially high priority |
| Median age of open valid reports | Overall aging | Rising quarter over quarter |
What not to measure
Be careful with report volume as a score of security. Volume depends on scope, publicity and reward more than on code quality. Our post on whether bounty report volume measures security explains why.
Do not use raw counts to compare teams. A team that owns a public login flow will receive more reports than one that owns a batch job.
Targets to compare against
BOD 20-01 sets recommended targets, described as guidance and not mandatory remediation dates: acknowledge receipt within 3 business days, finish an initial assessment within 7 days, and resolve within 90 days, with critical issues treated faster and complex multi-party cases allowed more time. Use them as a reference, then set your own.
How to collect
You need dates at each step in your case record: received, first reply, validated, fixed, closed. If those are filled in, medians are a spreadsheet formula. See fields for a tracking record.
Review rhythm
Look at the numbers monthly with the people who own fixes, and share a short summary quarterly with leadership. If a number looks bad, ask what step is stuck, not who is slow.
Where Safeguard fits
For issues tied to open source dependencies, Safeguard's vulnerability management view tracks findings and fix status across projects, so those cases are easier to age and report. You can try a free scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through the findings and look at how age and status are shown, the same view you want for reported cases.
Quick check
Is a lower report count better?
Not necessarily. Few reports can mean few researchers know where to report, or that your scope is narrow.
What is the one metric to start with?
Median time to first response. It is easy to measure and shapes how reporters treat you.
Sources
Last reviewed: 19 October 2026.
