Track how fast you revoke leaked credentials, how many long lived credentials remain, how much of your code and pipelines are scanned, and how many secrets rotate on schedule. Four or five numbers, reviewed monthly, tell you more than a dashboard of alert counts.
Why alert counts mislead
A rising alert count can mean more leaks or better detection. A falling count can mean fewer leaks or a switched off rule. Counts alone do not say which. Measures tied to outcomes and coverage are harder to game.
Metrics worth tracking
| Metric | What it answers | Healthy direction |
|---|---|---|
| Time to revoke a live leaked secret | How fast do we contain? | Down |
| Share of alerts that were live when found | Is prevention working? | Down |
| Repositories and pipelines with scanning enabled | How much do we cover? | Up to all |
| Secrets with an owner recorded | Can we act on an alert? | Up to all |
| Long lived credentials still in use | How much standing risk? | Down |
| Secrets rotated within their schedule | Is rotation real? | Up |
| Bypass events on push blocking | Is the control respected? | Low and explained |
How to collect each one
- Time to revoke. Record alert time and revoke time in the ticket. Report the median and the slowest.
- Live share. When closing an alert, tag it live, dead or test.
- Coverage. List repositories from your source host and compare with the scanner's list. The gap is the number.
- Owners. Keep an inventory with an owner field. OWASP's cheat sheet stresses audit logging of secret access, use and admin actions, which an inventory complements.
- Long lived credentials. Count static keys and tokens by age from your providers. Cloud providers typically show key age, and AWS documentation, for example, notes an access key age column in its IAM console.
- Rotation. Compare last rotated against the policy for each secret.
Metrics to avoid
- Raw findings per month, without context.
- Number of scans run. Activity is not protection.
- Percentage of false positives alone. A low rate can mean a blind scanner.
Using the numbers
Set one target per quarter. For instance, bring unowned secrets to zero, or cut the slowest revoke time. Show the trend to engineering leads, not a blame list. For audit purposes, keep evidence of reviews, since auditors usually want to see that a control operates, not only that it exists.
Try it yourself
Click through it at your own pace, or open it full screen. See how one control and its evidence can be mapped to several compliance frameworks.
Quick check
How many metrics are too many?
More than you will review monthly. Start with four and add one only when a question demands it.
Who should own these numbers?
Security usually reports them, but each engineering team should own its own coverage and rotation figures.
Safeguard supports compliance and evidence automation, and a free scan gives a starting baseline.
Sources
Last reviewed: 19 October 2026.
