A useful exposure dashboard fits on one page and answers three questions: how long are we exposed, where does the time go, and what is stuck right now. Six panels cover it: stage times, oldest open findings, alerts without a fix PR, deploy lag, active exceptions and a trend line.
Principles first
- One page. If it needs scrolling, people stop reading it.
- Per service tier. DORA's guidance warns against blending metrics across very different services. Group by criticality or exposure instead.
- Distributions, not just averages. A long tail hides inside a mean. Show the median and a high percentile.
- Actions, not decoration. Each panel should point to a person who can act.
The six panels
| Panel | Question it answers | Source |
|---|---|---|
| Stage times | Where does time go? | Timestamps from alert, PR, merge, deploy |
| Oldest open findings | What is stuck longest? | Findings list sorted by age |
| Alerts with no fix PR | What has no path forward? | Alerts minus linked PRs |
| Deploy lag | Which fixes are merged but not running? | Merge versus deploy per service |
| Active exceptions | What have we accepted, and until when? | Exception register |
| Trend | Is it getting better? | Monthly median of total window |
How to build each
- Stage times. Split into detect to triage, triage to PR, PR to merge, merge to deploy, deploy to verify. Use a stacked bar per month.
- Oldest open. List the top ten with owner and next step. Age is measured from advisory publication or first detection, state which.
- No fix PR. Use the alerts list and remove those with linked pull requests. Each remaining row needs a reason: no patch, parent blocked, rule filtered.
- Deploy lag. A table of services where the latest merged security fix has not been deployed. This panel is often the most surprising.
- Exceptions. Count, oldest, and any past their review date.
- Trend. One line of the median total window, with the high percentile as a second line.
What to leave off
- Total vulnerability counts with no age. They reward neither speed nor care.
- Percent patched with no definition. Our earlier posts on this point explain why.
- Severity pie charts. They show volume, not time.
How to use it
Review weekly with engineering leads. The agenda is fixed: look at deploy lag, then the oldest open items, then the no-PR list. Assign one action per row. Monthly, look at the trend and ask which stage moved.
Keep the definitions in a short note under the dashboard: when the clock starts, when it stops, what counts as fixed. Without it, two people will read the same number two ways.
Try it yourself
Open the demo and see how findings are summarized across a portfolio, then sketch which panels you would add for your team.
Click through it at your own pace, or open it full screen.
Safeguard's compliance and evidence automation can keep records for the data behind these panels. Try a free scan at gold.safeguard.sh/scan.
Quick check
Which panel matters most?
Deploy lag, because a merged fix that is not running is the easiest exposure to miss.
Should I report an average?
Report the median and a high percentile. An average hides the tail.
Sources
Last reviewed: 19 October 2026.
