Metrics and queries for security
Metrics and queries for security
The useful security metrics measure response, not inventory. A count of open vulnerabilities says little without knowing how fast they close.
| Metric | Signals |
|---|---|
| Mean time to remediate, by severity | Whether findings actually get fixed |
| Open findings by age | Whether a backlog is accumulating |
| New findings per release | Whether the codebase is getting safer |
| Secret scanning alerts | Credentials reaching the repository |
| Dependency currency | Whether a patch would even be mergeable |
Age beats count
Fifty findings all under a week old is a working process. Five findings each two years old is a broken one, even though the count looks better. Reporting age distribution rather than a total is what distinguishes the two, and it resists the temptation to close findings by reclassifying them.
Remediation time by severity
Aggregating remediation time across severities hides the thing that matters. Critical findings closing in 3 days and lows in 200 is a healthy triage; both at 60 days means severity is not driving behaviour at all.
Dependency currency as a leading indicator
Time-behind-latest predicts your ability to respond before an incident happens. A project several majors behind cannot take a security patch without a migration, so its future remediation time is already determined — the metric tells you today what next quarter's response will cost.
Primary sources