Executives need a few metrics that change decisions: how many exposed, reachable or exploited issues are open, how old the oldest ones are, how long fixes take, and how much of the estate is covered by scanning. Counts of total findings and average scores rarely help and often mislead.
What a metric must do
A useful metric answers "should we act, and where?" If a number goes up and nobody changes anything, it is decoration. Pick metrics that trigger a decision.
Five metrics worth reporting
| Metric | Definition | Decision it supports |
|---|---|---|
| Open exploited issues | Open findings that appear in a known-exploited list, on systems you run | Whether to interrupt other work |
| Open reachable, exposed issues | Findings whose vulnerable code your application can call, on internet-facing systems | Where to put engineering time |
| Age of oldest open items | Days since confirmation, for the oldest few in each category | Whether the process is stalling |
| Time to fix | Median days from confirmation to fix or mitigation, by category | Whether targets are realistic |
| Coverage | Share of services and repositories scanned within a set period | Whether the other numbers can be trusted |
The first uses CISA's list of vulnerabilities known to be exploited in the wild, which CISA recommends as an input to prioritization (CISA KEV).
Metrics to leave out
- Total open findings. It grows with scanner coverage, so an improving program can look worse.
- Average CVSS. FIRST says the score measures severity and should not be used alone to assess risk (FIRST). Averaging also hides the few findings that matter.
- Number of scans run. Activity, not outcome.
Defend every definition
Write the definition under each number in the report. State the date range, the systems in scope, and what counts as fixed. If the definition changes, mark the break in the trend line. Executives lose trust fast when a chart quietly changes meaning.
Show trends and exceptions
One number alone says little. Show the last six months, and call out exceptions: items past target, with owner and reason. Keep the page to one screen.
Pair each metric with a question
When you present, attach a question to each number: "Why is the oldest item 94 days old?" This keeps the discussion on decisions rather than on whether the number is good or bad.
Watch for gaming
Any target invites gaming. If time to fix is rewarded, items get closed as accepted. Counter this by reporting acceptances alongside fixes and reviewing a sample each quarter.
Try it yourself
Click through it at your own pace, or open it full screen. Click through the dashboard and ask of each number: what decision does this support? Compare it to the five metrics above.
Where Safeguard fits
Safeguard offers dependency scanning, reachability analysis and compliance evidence automation, which produce the underlying data for these metrics. The free scan is at gold.safeguard.sh/scan.
Quick check
Should we report total findings?
Not as a headline. Report it in an appendix with a note that it depends on scanner coverage.
How many metrics are too many?
More than about five on the main page. Put the rest in an appendix.
Sources
Last reviewed: 19 October 2026.
