An executive ASPM report should fit on one page and show four things: the trend in time to fix, how many known exploited items are past due, how much work has an owner, and the exceptions that are about to expire. Leave raw finding counts for the working team.
What executives actually need
Leaders are deciding whether to fund, staff or slow down. They want to know whether the program is improving, where it is stuck and what they are asked to decide. A forty page export of findings answers none of those.
The one page layout
| Section | Content | Why it is there |
|---|---|---|
| Headline | One sentence on direction this quarter | Sets context |
| Time to fix | Median days by priority tier, last four quarters | Shows speed |
| Exploited and overdue | Items listed as exploited that are past your target | Shows urgent risk |
| Ownership | Share of findings with a named team | Shows accountability |
| Exceptions | Active, expiring this month, renewed | Shows decisions made |
| Asks | What you need from leadership | Makes the report actionable |
Choosing the exploited item list
CISA describes its Known Exploited Vulnerabilities catalog as the authoritative source of vulnerabilities that have been exploited in the wild. Using it for this section gives you a public, defensible definition that does not depend on a vendor score. State clearly how many of those items affect products you run, and how many are past your own deadline.
What to leave out
- Raw totals. A number like thousands of open findings creates alarm without direction.
- Tool names and scanner statistics. Executives do not manage scanners.
- Jargon. Say "known to be exploited" not "KEV tier one."
- Unexplained color coding. If red appears, add a sentence saying why.
Add context to every number
A metric without a comparison is hard to read. Always show last quarter next to this quarter, and a target if you have one. Add a sentence on any change over ten percent, saying whether it is a real improvement or a change in how you measure.
Tell the truth about limits
Say what the report does not cover, such as products not yet connected or scanners not yet ingested. Overconfident reports damage trust more than incomplete ones. NIST's SSDF, SP 800-218, treats vulnerability response as an ongoing practice, which is a useful framing for leaders: the number will not reach zero, so the goal is a healthy, steady process.
A cadence that works
- Monthly: short update to the security and engineering leads.
- Quarterly: the one pager to the executive team.
- Annually: a deeper review of policy and targets, including whether the metrics still match the risks.
A worked example of the one page report
Here is how a hypothetical quarterly page could read. The figures are invented.
Headline: Urgent items are being fixed faster, but older medium priority work is growing.
| Measure | Last quarter | This quarter | Comment |
|---|---|---|---|
| Median days to fix, urgent | 21 | 12 | Improved after routing change |
| Exploited items past due | 6 | 1 | One waiting on a vendor patch |
| Findings with a named owner | 62 percent | 88 percent | Ownership map completed |
| Active exceptions | 14 | 17 | Three added for a legacy system |
| Exceptions expiring next month | n/a | 4 | Reviews scheduled |
Asks: Approve two sprint slots to retire the legacy system that drives the new exceptions.
Notice the structure: a headline, five numbers with comments and one specific request. A reader can absorb it in two minutes and decide.
Step by step: preparing the report each quarter
- Pull the five numbers from the platform and tracker.
- Write a draft headline in one sentence.
- Add a comment to each number that changed noticeably.
- Choose one ask. If there is nothing to ask, say so.
- Have a peer who does not work in security read it and tell you what they understood.
- Revise, send and file a copy.
Questions executives often ask
- Are we exposed to what is in the news? Prepare a short answer in advance: what you checked, what you found and what you did.
- Are we better than last year? Compare to your own history, not to claimed industry numbers, unless you can cite a source.
- What do you need from me? Always have an answer.
Customer facing version
A shorter, sanitized version of the page can support customer conversations. Remove internal names, specific vulnerabilities and anything covered by an agreement. Keep process descriptions, cadence and outcomes in general terms. Have security and legal review before sharing.
Avoiding report fatigue
If the same page goes out unchanged every quarter, readers stop looking. Change one thing each time: add a short story about a specific improvement, or highlight one risk you are watching. Variety keeps attention without making the report longer.
Where Safeguard fits
Safeguard provides compliance and evidence automation and policies, gates and guardrails, which supply data for reports like this. Try a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen. Think about which view you would put on your one pager.
Quick check
Should executives see individual findings?
Rarely. Show trends and decisions. Keep detail available if they ask.
How often should the report go out?
Quarterly for executives, with a shorter monthly note if they want one.
Should the report include a risk score for the whole company?
Be careful. A single score hides detail and invites arguments about the formula. If you use one, explain how it is built and always show the underlying measures.
Sources
Last reviewed: 19 October 2026.
