Five measures tell you whether an SDK and API inventory is healthy: coverage of discovered integrations, freshness of rows, share with a valid owner, completion of reviews, and the time it takes to answer "who uses this vendor?" Track them quarterly and prefer trends to targets.
Why measure at all
An inventory can look complete and be wrong. A row count says nothing about whether the rows are true. These measures check the list against reality and against the people who are supposed to maintain it.
The five measures
| Measure | How to calculate | What it tells you |
|---|---|---|
| Coverage | Integrations found by discovery that have a row, divided by all integrations found | Whether the list matches reality |
| Freshness | Share of rows confirmed within your window, such as 12 months | Whether rows are still true |
| Ownership | Share of rows whose named owner is still active on the team | Whether anyone can answer for the row |
| Review completion | Rows with a completed risk or data review, among rows that send personal or sensitive data | Whether the high-risk ones are looked at |
| Time to answer | Minutes to list every service that uses a named vendor | Whether the inventory works under pressure |
How to get the numbers
- Coverage needs two independent sources. Use dependency scans for packages and outbound traffic for hosts. The denominator is the union of what those sources find.
- Freshness needs a last confirmed date on every row.
- Ownership needs the owner field to point to a directory entry, so a script can check who left.
- Review completion needs a data class column and a review status.
- Time to answer is a drill. Once a quarter, pick a vendor name at random and time how long it takes to produce the list of services, owners and data classes.
Pitfalls
Coverage is only as good as the discovery behind it. A high percentage from a weak source is false comfort, so mention the source with the number. Do not reward teams for row counts, since that encourages splitting one integration into many. And avoid fixed targets at the start. A first measurement of 60 percent coverage that rises each quarter is a better story than a made-up 95 percent goal.
OWASP describes an outdated or missing host inventory as one of the signs of a documentation blindspot. These measures are a way to check whether you have that problem.
Reporting
Share one page with leadership: five numbers, last quarter beside this quarter, and the top three actions. Include the unmatched list size as a plain count. If a number falls, explain why, for example a new acquisition added many unknown integrations.
Try it yourself
Open the vulnerability management demo and see how it groups findings. Think about which of the five measures above you could present the same way.
Click through it at your own pace, or open it full screen.
Quick check
Is 100 percent coverage realistic?
Rarely. Aim for steady improvement, and investigate every gap between sources.
What is the easiest measure to start with?
Time to answer. It needs no tooling, only a stopwatch and a vendor name.
Safeguard offers SBOM and dependency scanning and asset discovery that can feed this kind of inventory. You can run a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
