A useful scorecard fits on one screen and has six metrics: owner present, last scan age, known exploited findings, oldest open high severity item, base image age, and lockfile or SBOM coverage. Each metric names an action. A scorecard with fifty numbers gets ignored.
Principles
Score what a team can change. Avoid composite grades that nobody can explain. Show the trend, not just the value, and always show the owner. A scorecard exists to help a team decide what to do on Monday.
The six metrics
| Metric | Why | Action it triggers |
|---|---|---|
| Owner present and valid | Without one, nothing else matters | Assign a steward |
| Days since last successful scan | A missing scan looks like a clean one | Fix the pipeline |
| Known exploited findings open | Listed by CISA as exploited in the wild | Fix first |
| Age of oldest open high severity finding | Shows neglect | Plan the fix |
| Base image age or newest digest behind | Many findings come from the base | Rebuild |
| Lockfile or SBOM coverage | Cannot assess what is not recorded | Add generation |
CISA describes its Known Exploited Vulnerabilities catalog as the authoritative source of vulnerabilities exploited in the wild, so a simple count of open items on it is a defensible headline number.
Display rules
- Use three states per metric: fine, needs work, urgent. Define the thresholds in advance and publish them.
- Show the service tier next to the name, so a reader knows how strict the thresholds are.
- Sort services by urgent count, not alphabetically.
- Give every red cell a link to the finding or the how to fix page.
Fleet roll up
Aggregate by team and by system. Leaders ask "which team is struggling", and the answer should be there without a spreadsheet. But be careful: ranking teams against each other can encourage gaming. Present it as a work queue, not a league table.
Avoid these traps
- Counting findings in total. It rewards services with fewer dependencies, not better practice.
- Rewarding suppression. If closing a finding as accepted improves the score, expect more acceptance.
- Scoring unknowns as passes. If a scan did not run, the cell should be red, not green.
Review cadence
Review scorecards with team leads monthly. Ask one question per team: what is the single biggest item, and when will it be done. Close the loop in the next review.
Try it yourself
Click through it at your own pace, or open it full screen. Look at which signals change over time.
Quick check
Should the scorecard produce one overall grade?
Usually not. A single grade hides what to fix. Show the six metrics with their states.
What if a metric cannot be measured yet?
Show it as unknown and treat unknown as needing work until the data exists.
Safeguard's continuous monitoring and compliance evidence automation can supply many of these inputs, and a free scan shows one project's data.
Sources
Last reviewed: 19 October 2026.
