Dashboard section

The dashboard contains summary graphs (widgets) for vulnerabilities over the selected period. Data updates once a day.

The dashboard includes the following widgets:

• Cumulative graph of detected vulnerabilities;
• Total number of open vulnerabilities;
• Most common open vulnerabilities;
• Most common critical and high vulnerabilities;
• Most vulnerable projects;
• Mean Time to Detect (MTTD);
• Security metrics;
• Scan Frequency Ratio;
• Number of vulnerabilities;
• Security Defect Lead Time;
• Fixed Vulnerabilities;
• Number of duplicate vulnerabilities;
• Number of false positives;
• Mean Time to Resolve;
• Risk Density;
• Integrated Risk Index.

Cumulative graph of detected vulnerabilities

This widget shows how vulnerability detection changes over the selected period and lets you analyze changes in the total number of security issues.

Total number of open vulnerabilities

This widget shows the total number of detected vulnerabilities, grouped by severity level and status.

Most common open vulnerabilities

This widget shows the number of unresolved security issues that require processing or remediation.

Most common critical and high vulnerabilities

This widget shows a list of the most critical security issues with a high risk level and remediation priority.

Most vulnerable projects

This widget shows projects with the highest number of detected security issues during the selected period.

Mean Time to Detect (MTTD)

This widget shows the average time between when a security issue appears and when analysis tools detect it.

Security metrics

This widget shows key performance indicators for secure development processes and security issue handling.

Scan Frequency Ratio

This widget shows the intensity of security checks and how often projects start scans.

Number of vulnerabilities

This widget shows the total number of detected security issues during the selected period.

Security Defect Lead Time

This widget shows the median time that a security issue exists from detection to closure.

Fixed Vulnerabilities

This widget shows the ratio of closed security issues to the total number of detected vulnerabilities.

Number of duplicate vulnerabilities

This widget shows the number of security issues that the system identified as duplicates.

Number of false positives

This widget shows the number of false-positive vulnerabilities.

Mean Time to Resolve

This widget shows the average time spent resolving security issues.

Risk Density

This widget shows the concentration of security issues relative to the size of the analyzed application or project.

Integrated Risk Index

This widget shows the project's overall risk level based on the severity and number of detected vulnerabilities.

Metric calculation formulas

Secure development practice coverage

The secure development practice coverage metric is calculated using the following formula:

$$Coverage\% = \frac{ \text{Number of systems using the practices} }{ \text{Total number of systems} } \times 100$$

Risk Density (M)

The Risk Density metric is calculated using the following formula:

$$M = \frac{ C_{\text{critical}} \cdot W_{\text{critical}} + C_{\text{high}} \cdot W_{\text{high}} + C_{\text{medium}} \cdot W_{\text{medium}} + C_{\text{low}} \cdot W_{\text{low}} + C_{\text{undefined}} \cdot W_{\text{undefined}} }{ C_{\text{all}} }$$

where:

• $C_{\text{critical}}$—number of critical vulnerabilities in the project;
• $C_{\text{high}}$—number of high-severity vulnerabilities in the project;
• $C_{\text{medium}}$—number of medium-severity vulnerabilities in the project;
• $C_{\text{low}}$—number of low-severity vulnerabilities in the project;
• $C_{\text{undefined}}$—number of vulnerabilities with an undefined severity level in the project;
• $W_{\text{critical}}$, $W_{\text{high}}$, $W_{\text{medium}}$, $W_{\text{low}}$, $W_{\text{undefined}}$—weight coefficients for each severity level;

Note: $W_{\text{critical}} = 1.0$, $W_{\text{high}} = 0.8$, $W_{\text{medium}} = 0.5$, $W_{\text{low}} = 0.2$, $W_{\text{undefined}} = 0.3$

• $C_{\text{all}}$—total number of vulnerabilities in the project.

The $C_{\text{all}}$ metric is calculated using the following formula:

$$C_{\text{all}} = C_{\text{critical}} + C_{\text{high}} + C_{\text{medium}} + C_{\text{low}} + C_{\text{undefined}}$$

Integrated Risk Index

The Integrated Risk Index is calculated using the following formula:

$$R = \sqrt[3]{H \cdot V \cdot L}$$

where:

• $H$—Risk Density;
• $V$—Scan Frequency Ratio;
• $L$—remediation time coefficient.

V coefficient

The V coefficient (scan frequency) is calculated using the following formula:

$$V = \frac{ F_{\text{project}} - F_{\text{min}} }{ F_{\text{max}} - F_{\text{min}} }$$

where:

• $F_{\text{project}}$—scan frequency in the project.
• $F_{\text{min}}$—minimum scan frequency across all projects.
• $F_{\text{max}}$—maximum scan frequency across all projects.

The formula normalizes the project's scan frequency against the minimum and maximum values across all projects. The V coefficient ranges from 0 to 1:

• A value close to 0 indicates a low scan frequency.
• A value close to 1 indicates a high scan frequency.

Defect remediation and identification time coefficient L

This coefficient measures how quickly vulnerabilities are resolved relative to the median value. It's calculated using the following formula:

$$L = \frac{ MTTR_{\text{current}} + MTTD_{\text{current}} }{ MTTR_{\text{median}} + MTTD_{\text{median}} }$$

where:

• $MTTR_{\text{current}}$—Mean Time to Resolve a vulnerability.
• $MTTD_{\text{current}}$—Mean Time to Detect a vulnerability.
• $MTTR_{\text{median}}$—median vulnerability resolution time across all projects.
• $MTTD_{\text{median}}$—median vulnerability detection time across all projects.

The L coefficient shows how defect processing time differs from the median values:

• An $L < 1$ value means that the project resolves and detects vulnerabilities faster than the median.
• An $L = 1$ value corresponds to the median level.
• An $L > 1$ value means that the project processes vulnerabilities more slowly than the median.

Other metrics

Fixed Vulnerabilities

This metric is calculated as the ratio of the number of closed vulnerabilities to the total number of vulnerabilities in the project.

Average time in a specific status

This metric is calculated as the median time spent in each status, expressed as a whole number of hours.

Defect lead time

Defect lead time is calculated as the median defect lifetime, that is, from the New status to any closed status, for example, Fixed.

Mean Time to Detect (MTTD)

This metric is calculated as the median time to identify defects in the project or projects. Defect identification means changing the status from New to any subsequent status.

Mean Time to Resolve (MTTR)

This metric is calculated as the median time from an open status other than New to a closed status.