A board summary should answer five questions on one page: what software do we depend on, where are we exposed, who owns fixing it, what evidence can we show, and what decision do we need. Keep it to a handful of measures with dates and owners, and write plain words, not scanner output.
Why one page
Directors rarely need a vulnerability list. They need to know whether management has visibility, whether a known exposure exists, and whether anything needs money, time or a policy decision. A page forces the author to choose. It also makes trends visible when you reuse the same layout each quarter.
The five blocks
1. Inventory. Do we have a current SBOM for each product we ship? State the number of products with one, the number without, and the date of the last refresh.
2. Exposure. How many open findings sit in components that are exploited in the wild or reachable from our code? Link this to CISA's KEV catalog for the exploited count, and say what you counted.
3. Ownership. Who is accountable for each product's dependencies? Name roles, not committees.
4. Evidence. What can we hand a customer or auditor today? List the items: SBOM, scan history, policy, gate records. Do not list anything in progress as done.
5. Decisions. One to three asks, each with a cost, a date and a risk of doing nothing.
A layout you can copy
| Block | Measure | Value | Trend | Owner |
|---|---|---|---|---|
| Inventory | Products with current SBOM | n of m | up or down | Engineering lead |
| Exposure | Open exploited or reachable findings | n | up or down | Security lead |
| Ownership | Products with named owner | n of m | steady | CTO |
| Evidence | Items ready for customers | list | up or down | Compliance |
| Decisions | Open asks | 1 to 3 | CTO |
Rules for honest reporting
- Define each measure in one sentence, and keep the definition fixed.
- Show dates. A number without a date is a rumour.
- Say what is not covered. If three acquired products are not yet scanned, put that on the page.
- Do not claim a certification or attestation unless it has been issued, and say who issued it.
- Keep appendices for detail and the page for judgement.
Questions a director may ask
- Is this number good or bad? Add a target next to the value.
- What changed since last quarter? That is the trend column.
- What would you do with more budget? That is the decision block.
Try it yourself
Open the demo and see how continuous monitoring turns a portfolio into trend lines. Think about which of those lines would earn a place on your page.
Click through it at your own pace, or open it full screen.
Safeguard's SBOM generation, dependency scanning and compliance evidence automation produce the numbers this page needs. Try a free scan to see the first block for one project.
Quick check
How often should the page be refreshed?
Quarterly suits most boards, with an interim note after a major event. Match your own board calendar.
Should the page show severity counts?
Only if you define them and add exploitation or reachability. Raw severity counts mislead.
Sources
Last reviewed: 19 October 2026.
