Percent or count: the denominator problem in security metrics

A percentage is only as honest as its denominator. "95 percent of assets scanned" sounds strong, but if the denominator is the list you already know about, the real coverage may be far lower. Always state what the percentage is a share of, and show the raw count next to it.

The classic case

Illustrative numbers. Your inventory lists 400 assets and 380 are scanned, so 95 percent. Later, discovery work finds that 1,000 assets actually exist. Now 380 of 1,000 is 38 percent.

Nothing about the scanning changed. The denominator was wrong. The first figure was accurate arithmetic on an incomplete list, and it hid the gap that mattered.

Four denominator traps

1. The known list. Coverage of what you know about says nothing about what you do not. Check how the list is built, and by whom.
2. The shrinking list. If items are removed from the denominator when they are exempted, accepted or retired, the percentage rises without any improvement. Track exemptions separately.
3. The moving list. A fast growing estate dilutes a stable numerator. Fixing 100 items per month looks smaller each month if arrivals double.
4. The tiny list. A ratio from 3 items is not stable. See small numbers and noise.

How to present a metric safely

Write each metric as three parts: numerator, denominator, source of denominator.

• "380 of 1,000 known assets scanned in the last 7 days. Denominator comes from the cloud account listing plus the device management export."
• "12 of 15 critical findings fixed within SLA. Excludes 2 accepted risks, listed in the appendix."

This takes ten more seconds to read and removes most arguments.

Counts and percentages answer different questions

• Counts answer "how much work is there" and "how much risk is open". 4,000 open findings is a workload no matter how many assets exist.
• Percentages answer "how are we doing relative to the size of the problem" and let you compare periods or teams of different size.

A report with only percentages hides scale. A report with only counts hides progress. Use both.

Improve the denominator first

The best way to make a coverage metric believable is to improve how the denominator is found. Reconcile at least two independent sources, for example cloud inventory against network scans, and report the gap between them. A large gap is itself the most useful finding. Our post on the scan coverage metric covers the definition step by step.

Safeguard includes asset discovery, which can help build the list that sits under a coverage number. You can start with the free scan at gold.safeguard.sh/scan to see what an inventory of one repository's dependencies looks like.

Quick check

Last reviewed: 19 October 2026.