Five metrics tell you whether triage is working: the age of the oldest open high severity finding, the share of findings with an owner, the confirmed rate per rule, the share of suppressions reviewed on time, and new versus fixed per week. Raw finding counts alone mislead.
Why counts alone mislead
A rising count can mean the scanner improved. A falling count can mean someone suppressed a rule. Neither tells you whether risk went down. Use measures that describe the process, not just the pile.
The five metrics
| Metric | How to compute | What a bad value suggests |
|---|---|---|
| Age of oldest open high finding | Today minus creation date | Escalation is not happening |
| Share of findings with an owner | Owned findings divided by all open | Routing is broken, see routing to owners |
| Confirmed rate per rule | Confirmed divided by reviewed, per rule | The rule is noisy and needs tuning |
| Suppressions reviewed on time | Reviewed by due date divided by due | Exceptions are going stale |
| New versus fixed per week | Count of each | New outpaces fixed, debt is growing |
Reading them together
If age is high and owners are missing, the problem is routing. If confirmed rate is low for a few rules, tune those and expect noise to fall. If suppressions are overdue while new findings are low, the team is hiding rather than fixing. Look for combinations, not single numbers.
Collect cleanly
- Take an export from your scanner in a stable format such as SARIF, and store it weekly.
- Keep status changes with a timestamp and a reason, see false positive, accepted risk or won't fix.
- Compute metrics by team and by rule, not only overall.
- Show a trend over at least a quarter. One week is noise.
Be careful with targets
When a measure becomes a target, people optimise the measure. Closing alerts to improve a number is easy. Pair every volume metric with a quality check, for example sample some closed findings each month and confirm they were handled correctly. For the cost side of noise, see the arithmetic of false positive alert fatigue.
What to leave out
Lines of code scanned, number of rules enabled and raw alert totals are inputs, not outcomes. Report them if you must, but not as success measures.
Try it yourself
Open the demo and look at how the dashboard separates open, new and fixed items.
Click through it at your own pace, or open it full screen.
One factual note on Safeguard
Safeguard offers compliance and evidence automation that can help keep this kind of history. If you want a quick look at your own code, the free scan at gold.safeguard.sh/scan is a no-account place to start.
Quick check
What is the single most useful metric?
The age of the oldest open high severity finding. It is hard to game and shows whether escalation works.
How often should I report these?
Weekly for the team, monthly for leadership, with quarterly trends.
Last reviewed: 19 October 2026.
