You can safely share your vulnerability management process, scan coverage, remediation targets, aggregate trends and the date of your last review. Keep exact open findings, asset names, internal hostnames and unpatched specifics private, because those details help an attacker more than they help a buyer.
What the customer is really asking
A buyer wants to know whether you find problems, fix them in a sensible time and can prove it. They rarely need your raw list. Offering the right level of summary usually satisfies the question and protects you.
Safe to share
| Item | Example form |
|---|---|
| Process | How scans run, who triages, how exceptions are approved |
| Coverage | Share of repositories and services under scanning |
| Targets | Your remediation targets by severity |
| Performance | Share of findings closed within target over the last quarter, with the count behind it |
| Trend | Direction over time, not the open list |
| Controls | Pull request checks, dependency review, release gates |
| Cadence | How often you report internally and review exceptions |
Give the denominator with any percentage. "92 percent within target" means little if it is 11 of 12.
Share only under NDA
Penetration test summaries, architecture details and a software bill of materials for the product you sell them are usually shared under an agreement or through a controlled portal. An SBOM is a reasonable ask in many procurement processes, and sharing one for what you actually ship is normal practice.
Do not share
- Live open critical findings with asset names.
- Credentials, tokens or internal URLs in screenshots.
- Anything about another customer.
- Claims you cannot back with evidence, for example a certification you do not hold.
Steps to prepare a standard pack
- Write one page on the process.
- Export an aggregate metrics sheet, dated, with definitions.
- Prepare a sanitized screenshot or report with names removed.
- Log what you sent, to whom and when.
- Refresh the pack quarterly.
Having the pack ready turns a two week scramble into a same day answer, and it keeps answers consistent between questionnaires.
Quick check
Should we send a customer our list of open vulnerabilities?
Generally no. Send aggregates and process evidence, and discuss specifics under NDA if they ask.
Is it fine to quote a percentage alone?
Include the count and period behind it so the figure can be checked.
Safeguard supports this with compliance and evidence automation and SBOM export, and you can run a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
