Report new and inherited vulnerabilities separately because they answer different questions. New findings show whether current work introduces risk. Inherited findings show how much old debt remains. Blending them makes active teams look bad for history and hides whether prevention is working.
The two groups
New: introduced by code or dependency changes in the current reporting window, or in a recent defined period, such as since the last release.
Inherited: present before the period began, whether from older code, acquired systems or dependencies that were added long ago.
A third group matters too. Newly disclosed findings are in dependencies you already had, but the advisory is new. They are inherited in code terms but are new in time. Many teams label them separately, because neither team behavior nor code age explains them.
| Group | Question it answers | Owner action |
|---|---|---|
| New, introduced by change | Is our delivery process safe? | Gate and review |
| Newly disclosed, existing code | How fast do we respond to advisories? | Triage and upgrade |
| Inherited, long standing | How much debt remains? | Plan and budget |
Why it matters
A team rewriting a legacy system may show a rising count of inherited items as a scan finally covers the old code. A team shipping fast might show few findings in old code but a steady stream of new ones. Without a split, the first looks worse and the second looks fine, which is the opposite of the useful reading.
Steps to build the split
- Record the first seen date for every finding.
- Record the commit or release in which the vulnerable component was introduced if you can.
- Define the reporting window and classify as new, newly disclosed or inherited.
- Chart the three as separate series.
- Add a note whenever scan scope changes, since new scope adds inherited findings.
How to set targets
New findings entering through a gate can reasonably target zero for the highest tier, because the gate can block them. Inherited debt needs a paydown plan with dated milestones. Newly disclosed items follow the SLA. Different groups, different targets.
For paying down older items in bulk, see bulk remediation of an aged vulnerability backlog.
Reporting language for executives
"New high risk items entering through releases: [number], blocked by the gate: [number]. Inherited debt in the top tier: [number], falling since [date]. Newly disclosed items closed within SLA: [share]." Replace the placeholders with measured values.
Safeguard's pull request gates and policies address new risk at the point of change, while dependency scanning and reachability analysis help size inherited debt. A free scan gives the first inventory.
Try it yourself
Click through it at your own pace, or open it full screen.
Browse the dependency inventory and think about which components are old and which are recent.
Quick check
Where do findings from a newly acquired company go?
Treat them as inherited with their own label and plan, so they do not distort the host teams' figures.
Can a finding move between groups?
No. Classify it once using first seen date and keep it stable, otherwise the trend becomes unreliable.
Last reviewed: 19 October 2026.
