Set red, amber, and green thresholds from two things: your written policy and your measured baseline. Green means inside policy, red means a policy breach that needs a decision, and amber is a short early warning band. Thresholds chosen without a baseline are guesses, and teams learn to ignore guesses.
Start from what you can defend
There are two honest sources for a line. One is your policy, for example a remediation target by severity and exposure. The other is the data: what the team has actually delivered over the last few quarters. Policy says where you want to be. The baseline says where you are.
If policy and baseline are far apart, a metric that starts deep in red for every team stops being informative. Use a glide path: set the first quarter's line near the baseline, then move it toward policy in steps that are announced in advance.
A five step method
- Pull three to four quarters of history for the metric.
- Find the median and the spread. Note the highest and lowest quarter.
- Set green at the policy value if teams already meet it most of the time, otherwise at an interim value.
- Set red where a breach needs a human decision, such as an item older than policy allows.
- Set amber as the band that gives owners time to act before red, for example when an item has used most of its allowed time.
Write all three lines in a definition card with the metric, the data source, and the owner.
Time based amber works better than percent based
For remediation age, define amber by time used. An item that has used most of its allowed window is amber, and one past the window is red. This turns the color into a countdown owners can plan around, which is better than a bucket that flips with small count changes.
| Color | Meaning | Who acts |
|---|---|---|
| Green | Inside policy | Nobody |
| Amber | Close to the limit | Service owner plans a fix |
| Red | Past the limit | Decision from the named executive |
Pitfalls
- Too many reds. If everything is red, nothing is. Reduce scope or adjust the glide path.
- Percent thresholds on tiny counts. Two items out of three is 67 percent and means little. Use counts when volume is low.
- Moving lines silently. Changing a threshold mid quarter breaks trend reading. Log every change.
- One line for all services. Segment by exposure or criticality so a low risk internal tool is not judged like a payment system.
Review cycle
Check thresholds each quarter. If a metric is green for a year with no effort, tighten it or retire it. If it is red despite sustained effort, check capacity and scope before blaming teams.
Where Safeguard fits
Safeguard can help with the inputs behind this. It runs SBOM and dependency scanning, reachability analysis to separate reachable findings from the rest, and policies and gates that you set. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how findings are grouped by severity and status, then imagine where your own lines would sit.
Quick check
Should executives set the thresholds?
They should approve them. Security and engineering draft them from policy and data so the lines are realistic.
Can a metric have only red and green?
Yes, for hard rules such as expired exceptions. Amber helps for countdown style metrics.
Last reviewed: 19 October 2026.
