Chart open vulnerabilities by age bucket: 0 to 7 days, 8 to 30, 31 to 90 and over 90, stacked by severity. This shows how much old exposure you carry, which a mean time to fix figure cannot show because it only counts findings that have already been closed.
Why age beats an average
Mean time to remediate looks backward. It describes items you finished. The findings that hurt you are the ones still open, and the oldest ones are usually the hardest or the most neglected. An age chart looks at the open population directly.
Building the chart
- Take every open finding as of today.
- Compute age from your chosen clock start (discovery, publication or triage; pick one and document it).
- Assign each to a bucket.
- Stack the bars by severity, or by asset tier if you use tiers.
- Repeat weekly and compare the shape over time.
A starting set of buckets:
| Bucket | Reading |
|---|---|
| 0 to 7 days | Normal intake |
| 8 to 30 days | In progress, inside most high severity SLAs |
| 31 to 90 days | Needs attention |
| Over 90 days | Chronic: fix, redesign or formally accept |
Align the boundaries with your SLA. If criticals must close in 15 days, add a bucket edge at 15.
Reading the shape
A healthy chart has most weight on the left and a thin right tail. A chart with a fat right bar is a backlog problem, and the response is not "work faster". It is usually one of three things: findings nobody owns, fixes that need a major upgrade, or noise that should be triaged out.
For the third case, check reachability. A vulnerable function that your code never calls is a candidate for documented acceptance with an expiry, which moves it out of the chronic bar honestly.
Pairing with other views
Show the oldest open critical and high item by name. A chart is easy to ignore, a named item with an owner is not. Add a count of items past SLA, with the denominator beside it, so a small team does not read two overdue items as a crisis or a triumph.
Common mistakes
- Resetting age when a finding is re-detected. Keep the first seen date.
- Mixing clock definitions across teams.
- Hiding accepted items. Show them as a separate hatched segment.
Try it yourself
Open the demo and sort findings by severity. Imagine each row with an age attached, and which bucket it would fall in.
Click through it at your own pace, or open it full screen.
Safeguard supports this with vulnerability tracking and reachability analysis, and you can run a free scan at gold.safeguard.sh/scan.
Quick check
Which clock start should age use?
Any consistent one. Document whether it is discovery, publication or triage, and never change it silently.
Why not just report mean time to fix?
It ignores open items, so the oldest exposure never appears in it.
Last reviewed: 19 October 2026.
