Yes, segment time to remediate by finding source: dependencies, first party code, container images and secrets. Each type has a different fix path and a different natural speed, so one blended number hides the slow category behind the fast ones and sends the team after the wrong problem.
Why blending fails
A dependency bump can be a one line change that a bot opens as a pull request. A code flaw needs a developer to understand and rewrite logic. A container base image fix needs a rebuild and redeploy. An exposed secret needs rotation, which is quick but cross-team.
If dependency fixes dominate your volume, the blended median looks excellent while code findings quietly age.
What to measure per source
| Source | Typical fix path | What to watch |
|---|---|---|
| Dependency | Version bump, lockfile change | Major upgrades that break builds |
| First party code | Code change and review | Queue time before work starts |
| Container image | Rebuild on a patched base | Rebuild cadence of base images |
| Secrets | Revoke and rotate | Time to revoke, not time to delete from history |
| Infrastructure as code | Configuration change | Drift reintroducing the issue |
Use the median and a high percentile such as the 90th, for each source and each severity. Counts matter too: a percentile from four items is unstable.
Steps
- Tag each finding with its source at ingestion.
- Fix the clock definition and use it for all sources.
- Compute median and 90th percentile per source and severity per quarter.
- Present them in one small table, not four charts.
- Investigate the slowest cell, and ask whether the cause is queue time, effort or ownership.
What the segments tell you
If dependency time is short but code time is long, invest in code review capacity or secure coding support. If container time is long, look at how often base images are rebuilt. If secrets time is long, rehearse the rotation runbook.
Keep the overall figure too
Do not throw the blended number away. Keep it for the board, with the segmented view for operations. State the mix: "62 percent dependency findings this quarter". Mix shifts can move the blend with no change in team behaviour.
Try it yourself
Open the demo and note how findings from a container image appear alongside other types. Consider how you would label each source.
Click through it at your own pace, or open it full screen.
Safeguard covers dependency scanning, container scanning and static analysis findings in one place, and you can run a free scan at gold.safeguard.sh/scan.
Quick check
Is the median or the mean better here?
Report the median and a high percentile. A mean is pulled around by a few outliers.
What if a source has very few findings?
Show the count and avoid reading much into the percentile.
Last reviewed: 19 October 2026.
