Read your security dashboard
Three numbers to watch, two distractions to ignore, and when to drill in.
Updated · dashboard · triage
The dashboard looks busy on purpose — it's meant to answer the “are we worse than last week?” question at a glance. If you're staring at it every morning and not sure what to look at, here's the short version.
Watch these three
- Critical findings open: the only count that should ever be zero. If it's not, page whoever owns the affected asset.
- Mean time to remediate (MTTR): trending down means triage is working. Trending up usually means a specific team or owner is underwater.
- New findings this week: sudden spikes correlate with deploys, dependency updates, or newly-disclosed CVEs. Correlate with your change log.
Distractions
Total finding count and informational-severity counts are useful for capacity planning, not for daily operations. A finding count dropping doesn't always mean you're safer — it might mean a scan misconfiguration.
When a number surprises you, drill into the timeline view for that metric — most spikes are explained by a single event (a new asset, a policy change, a public CVE).