A useful CI security dashboard has six panels: coverage, gate outcomes, scan speed, developer friction, exceptions and fix flow. Each panel should answer one question that someone will act on. If a panel has no owner who looks at it, remove it.
Start from questions, not charts
Dashboards grow into walls of graphs because adding a chart is easy. Start by writing the questions the dashboard must answer, and who will act on each answer.
The six panels
| Panel | Question | Owner |
|---|---|---|
| Coverage | Which repositories and branches run the checks, and which do not? | Platform or security |
| Gate outcomes | What share of runs pass, warn, block, error, skip or get overridden? | Security |
| Scan speed | How long is the wait, split into queue and run time, median and high percentile? | Platform |
| Developer friction | How often are checks retried, how long do blocked changes wait, what does the survey say? | Engineering leads |
| Exceptions | How many are active, how many expire soon, how many have no owner? | Security and risk |
| Fix flow | How many findings were introduced and fixed per week, and how old is the oldest open one? | Engineering and security |
What goes in each panel
Coverage. A list or heat map by repository, with a clear label for "no scan in the last period". Missing data is the most important thing this panel can show.
Gate outcomes. A stacked bar by week using your defined states. Keep error and skipped visible, not folded into pass.
Scan speed. Two lines for median and a high percentile, with queue time shown separately.
Developer friction. Re-run rate, time to unblock and the latest survey scores side by side.
Exceptions. Counts by age and expiry window, with a list of those past expiry.
Fix flow. Introduced versus fixed per week, plus the age of the oldest open finding.
Design rules
- Show the denominator next to every percentage.
- Slice by repository group, not by individual.
- Mark changes such as scanner upgrades or rule changes on the time axis, so shifts are explained.
- Make the dashboard load fast and be visible to developers, not just to security.
- Review it in a regular meeting with an agenda and actions, otherwise it becomes decoration.
What to leave out
Total vulnerability counts with no age or exposure. Leaderboards of developers or teams. Any number nobody can act on. Counts of scans run, which measure activity and not safety.
Try it yourself
Click through it at your own pace, or open it full screen. See how a monitoring view organises status and change over time.
Quick check
Do I need all six panels at once?
No. Begin with coverage and gate outcomes, then add the rest as you collect the data.
Who should see the dashboard?
Developers and engineering leads as well as security. Metrics that only the security team sees rarely change behaviour.
How Safeguard fits
Safeguard includes continuous monitoring, asset discovery, policies and gates, and compliance and evidence automation, which can supply data for panels like these. Try a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
