An age histogram groups open vulnerabilities by how long they have been open, using a few buckets such as newer than your SLA, past SLA, and far past SLA. Executives should see it by priority tier, because it shows whether the backlog is fresh work or neglected work.
What it shows that a total does not
An open count of the same size can mean two very different things. If most items are recent, the team is keeping pace and the pile is turnover. If most items are old, the pile is debt. The histogram separates the two at a glance.
It also gives you an early warning. When the oldest bucket starts to grow while the newest stays steady, work is stalling somewhere, usually ownership, a blocked dependency upgrade, or an unreviewed exception.
How to build the buckets
Do not use equal width buckets by default. Tie them to your SLA so the chart answers "are we late?" directly.
- Take your SLA per priority tier. Call the target the tier's limit.
- Make a bucket for within the limit.
- Make a bucket for past the limit but under twice the limit.
- Make a bucket for twice the limit or more.
- Count open items in each bucket, per tier, and stack the bars.
A table version works just as well in an email:
| Tier | Within SLA | Past SLA | Far past SLA |
|---|---|---|---|
| Priority one | count | count | count |
| Priority two | count | count | count |
| Priority three | count | count | count |
Fill the cells with your own counts. Do not borrow numbers from elsewhere.
Reading the chart
- A tall within SLA bar with small others means the process works.
- A growing far past SLA bar means the problem is structural, not effort.
- A priority one item in the far bucket deserves a named owner and a date in the commentary.
- A sudden jump in every bucket often means a new scan source or a wider scope, not a worse program. Annotate scope changes.
What to leave out of the executive version
Skip the per team detail unless asked, skip the raw list, and skip the average age. A mean age is dragged by outliers, as discussed in median or mean time to remediate. Keep the per item list in the engineering view and link it.
Pair it with exceptions
Old items are often old because someone accepted the risk. Show accepted items as their own bar or a hatched section, so approved exceptions are not mistaken for neglect, and so expired ones are visible. More in exception metrics: aging, renewals and coverage.
Safeguard's SBOM and dependency scanning and policies can supply the per finding data and exception records this chart needs. A free scan shows what the data looks like for one repository.
Quick check
How many buckets should the chart have?
Three or four. More makes the chart busy and the message vaguer.
Should the histogram include low severity items?
Show priority tiers separately and let leaders ask for the lower tiers. Mixing them dilutes the signal from the items that matter.
Last reviewed: 19 October 2026.
