Dashboard

The dashboard contains summary graphs (widgets) for vulnerabilities during the selected period. Data updates once a day.

The dashboard includes the following widgets:

• Cumulative graph of detected vulnerabilities;
• Total number of open vulnerabilities;
• Most common open vulnerabilities;
• Most common critical and high vulnerabilities;
• Most vulnerable projects;
• Mean Time to Detect (MTTD);
• Security metrics;
• Scan Frequency Ratio;
• Number of vulnerabilities;
• Security Defect Lead Time;
• Fixed Vulnerabilities;
• Number of duplicate vulnerabilities;
• Number of false positives;
• Mean Time to Resolve;
• Risk Density;
• Integrated Risk Index.

Cumulative graph of detected vulnerabilities

This widget shows vulnerability detection trends during the selected period. It also lets you analyze changes in the total number of security issues.

Total number of open vulnerabilities

This widget shows the total number of detected vulnerabilities, grouped by severity level and status.

Most common open vulnerabilities

This widget shows the number of unresolved security issues that require processing or remediation.

Most common critical and high vulnerabilities

This widget shows the most critical security issues with a high risk level and remediation priority.

Most vulnerable projects

This widget shows projects with the highest number of detected security issues during the selected period.

Mean Time to Detect (MTTD)

This widget shows the average time between the appearance of a security issue and its detection by analysis tools.

Security metrics

This widget shows key performance indicators for secure development processes and security issue handling.

Scan Frequency Ratio

This widget shows the intensity of security checks and how often scans run in projects.

Number of vulnerabilities

This widget shows the total number of detected security issues during the selected period.

Security Defect Lead Time

This widget shows the median time a security issue exists, from detection to closure.

Fixed Vulnerabilities

This widget shows the ratio of closed security issues to the total number of detected vulnerabilities.

Number of duplicate vulnerabilities

This widget shows the number of security issues that the system identified as duplicates.

Number of false positives

This widget shows the number of false-positive vulnerabilities.

Mean Time to Resolve

This widget shows the average time spent remediating security issues.

Risk Density

This widget shows the concentration of security issues relative to the size of the analyzed application or project.

Integrated Risk Index

This widget shows a summary of the project's risk level based on the severity and number of detected vulnerabilities.

Metric calculation formulas

Secure development practice coverage

The secure development practice coverage metric uses the following formula:

$$Coverage\% = \frac{ \text{Number of systems that use the practices} }{ \text{Total number of systems} } \times 100$$

Risk Density (M)

The Risk Density metric uses the following formula:

$$M = \frac{ C_{\text{critical}} \cdot W_{\text{critical}} + C_{\text{high}} \cdot W_{\text{high}} + C_{\text{medium}} \cdot W_{\text{medium}} + C_{\text{low}} \cdot W_{\text{low}} + C_{\text{undefined}} \cdot W_{\text{undefined}} }{ C_{\text{all}} }$$

where:

• $C_{\text{critical}}$—the number of critical vulnerabilities in the project;
• $C_{\text{high}}$—the number of high-severity vulnerabilities in the project;
• $C_{\text{medium}}$—the number of medium-severity vulnerabilities in the project;
• $C_{\text{low}}$—the number of low-severity vulnerabilities in the project;
• $C_{\text{undefined}}$—the number of vulnerabilities with an undefined severity level in the project;
• $W_{\text{critical}}$, $W_{\text{high}}$, $W_{\text{medium}}$, $W_{\text{low}}$, $W_{\text{undefined}}$—the weighting factors for each severity level;

Note: $W_{\text{critical}} = 1.0$, $W_{\text{high}} = 0.8$, $W_{\text{medium}} = 0.5$, $W_{\text{low}} = 0.2$, $W_{\text{undefined}} = 0.3$

• $C_{\text{all}}$—the total number of vulnerabilities in the project.

The $C_{\text{all}}$ metric uses the following formula:

$$C_{\text{all}} = C_{\text{critical}} + C_{\text{high}} + C_{\text{medium}} + C_{\text{low}} + C_{\text{undefined}}$$

Integrated Risk Index

The Integrated Risk Index metric uses the following formula:

$$R = \sqrt[3]{H \cdot V \cdot L}$$

where:

• $H$—Risk Density;
• $V$—Scan Frequency Ratio;
• $L$—the remediation time factor.

V factor

The V factor (scan frequency) uses the following formula:

$$V = \frac{ F_{\text{project}} - F_{\text{min}} }{ F_{\text{max}} - F_{\text{min}} }$$

where:

• $F_{\text{project}}$—the scan frequency for the project.
• $F_{\text{min}}$—the minimum scan frequency among all projects.
• $F_{\text{max}}$—the maximum scan frequency among all projects.

The formula normalizes the project's scan frequency against the minimum and maximum values across all projects. The $V$ factor ranges from 0 to 1:

• A value close to 0 indicates a low scan frequency.
• A value close to 1 indicates a high scan frequency.

Defect remediation and identification time factor L

This factor measures the speed of vulnerability remediation against the median value. It uses the following formula:

$$L = \frac{ MTTR_{\text{current}} + MTTD_{\text{current}} }{ MTTR_{\text{median}} + MTTD_{\text{median}} }$$

where:

• $MTTR_{\text{current}}$—the current Mean Time to Resolve a vulnerability.
• $MTTD_{\text{current}}$—the current Mean Time to Detect a vulnerability.
• $MTTR_{\text{median}}$—the median time to resolve vulnerabilities across all projects.
• $MTTD_{\text{median}}$—the median time to detect vulnerabilities across all projects.

The $L$ factor shows how defect handling time differs from median values:

• A value of $L < 1$ means that the project fixes and detects vulnerabilities faster than the median.
• A value of $L = 1$ corresponds to the median level.
• A value of $L > 1$ means that the project handles vulnerabilities more slowly than the median.

Other metrics

Fixed Vulnerabilities

This metric is calculated as the ratio of closed vulnerabilities to the total number of vulnerabilities in the project.

Average time in a specific status

This metric is calculated as the median time spent in each status, expressed as a whole number of hours.

Security Defect Lead Time

The Security Defect Lead Time is calculated as the median defect lifetime—from the New status to any closed status, for example, Fixed.

Mean Time to Detect (MTTD)

This metric is calculated as the median time to identify defects in one or more projects. Defect identification means changing the status from New to any subsequent status.

Mean Time to Resolve (MTTR)

This metric is calculated as the median time from an open status other than New to a closed status.