Information panel

The information panel contains summary graphs (widgets) for vulnerabilities over the selected period. The data updates once a day.

The information panel includes the following widgets (graphs):

• Cumulative graph;
• Open vulnerabilities;
• Most common open vulnerabilities;
• Most common critical and high vulnerabilities;
• Most vulnerable projects;
• Mean Time to Detect (MTTD);
• Metrics;
• Vulnerability count;
• Security Defect Lead Time;
• Fixed Vulnerabilities;
• Duplicate count;
• False-positive count;
• Mean Time to Resolve;
• Risk Density;
• Integrated Risk Index;
• Scan Frequency;
• Issues by security tool;
• Issues for selected tool.

How cumulative graphs work

The following graphs are cumulative, that is, their values increase over time:

• Security Defect Lead Time;
• Mean Time to Detect (MTTD);
• Mean Time to Resolve;
• Most common critical and high vulnerabilities;
• Integrated Risk Index;
• Scan Frequency;
• Fixed Vulnerabilities;
• Risk Density;
• False-positive count;
• Vulnerability count;
• Duplicate count.

Cumulative graphs get data from a shared cache that isn't tied to an individual user. To prevent excessive system load from frequent update requests, the system delays updates to the cached data. Environment variables define the delay and the setting that controls real-time data updates. The setting is enabled by default.

Depending on the setting, cumulative graphs use one of two update modes:

• when the setting is enabled, the data updates in real time with the specified delay between updates;
• when the setting is disabled, the data updates once a day, at 12:00 AM server time. The current server time accounts for the user's time zone and UTC.

Graph update time

Use the APP_CUM_CRON environment variable in the configuration file to configure the update time.

Cumulative graph

This widget shows vulnerability detection trends over the selected period and lets you analyze changes in the total number of security issues.

Open vulnerabilities

This widget shows the total number of detected vulnerabilities by severity level and status.

Most common open vulnerabilities

This widget shows the number of unresolved security issues that require processing or remediation.

Most common critical and high vulnerabilities

This widget shows a list of the most critical security issues with a high risk level and remediation priority.

Most vulnerable projects

This widget shows projects with the highest number of detected security issues over the selected period.

Mean Time to Detect (MTTD)

This widget shows the average time between when a security issue appears and when analysis tools detect it.

Metrics

This widget shows key performance indicators for secure development processes and security issue management.

Vulnerability count

This widget shows the total number of detected security issues over the selected period.

Security Defect Lead Time

This widget shows the median time a security issue exists, from detection to closure.

Fixed Vulnerabilities

This widget shows the ratio of closed security issues to the total number of detected vulnerabilities.

Duplicate count

This widget shows the number of security issues that the system identifies as duplicates.

False-positive count

This widget shows the number of false-positive vulnerabilities.

Mean Time to Resolve

This widget shows the average time spent remediating security issues.

Risk Density

This widget shows the concentration of security issues relative to the size of the analyzed application or project.

Integrated Risk Index

This widget shows the project's combined risk level based on the severity and number of detected vulnerabilities.

Scan Frequency

This widget shows the intensity of security checks and how often scans run in projects.

Issues by security tool

This widget shows the total number of vulnerabilities detected by the selected security tools.

Issues for selected tool

This widget shows the total number of vulnerabilities detected by one selected security tool.

Indicator calculation formulas

Secure development practice coverage

The secure development practice coverage indicator uses the following formula:

Coverage%
  = (Количество систем с применением практик
     / Общее количество систем) × 100

Risk Density (M)

The Risk Density indicator uses the following formula:

M = (C_крит × W_крит
     + C_хай × W_хай
     + C_медиум × W_медиум
     + C_лоу × W_лоу
     + C_неопредел × W_неопредел)
    / C_все

where:

• C_крит—the number of critical vulnerabilities in the project;
• C_хай—the number of high-severity vulnerabilities in the project;
• C_медиум—the number of medium-severity vulnerabilities in the project;
• C_лоу—the number of low-severity vulnerabilities in the project;
• C_неопредел—the number of vulnerabilities with an undefined severity level in the project;
• W_крит, W_хай, W_медиум, W_лоу, W_неопредел—weighting factors for each severity level:
  • W_крит = 1.0;
  • W_хай = 0.8;
  • W_медиум = 0.5;
  • W_лоу = 0.2;
  • W_неопредел = 0.3;
• C_все—the total number of vulnerabilities in the project.

The C_все indicator uses the following formula:

C_все = C_крит + C_хай + C_медиум
        + C_лоу + C_неопредел

Integrated Risk Index

The Integrated Risk Index uses the following formula:

R = (H × V × L)^(1/3)

where:

• H—Risk Density;
• V—Scan Frequency Ratio;
• L—the remediation time factor.

Coefficient V

The V coefficient (Scan Frequency) uses the following formula:

V = (F_проект - F_мин) / (F_макс - F_мин)

where:

• F_проект—the scan frequency in the project.
• F_мин—the minimum scan frequency among all projects.
• F_макс—the maximum scan frequency among all projects.

The formula normalizes the project's scan frequency against the minimum and maximum values for all projects. The V coefficient ranges from 0 to 1:

• a value close to 0 indicates a low scan frequency;
• a value close to 1 indicates a high scan frequency.

Defect remediation and identification time coefficient L

This coefficient evaluates the vulnerability remediation speed relative to the median value and uses the following formula:

L = (MTTR_текущая + MTTD_текущая)
    / (MTTR_медианная + MTTD_медианная)

where:

• MTTR_текущая—the current average time to remediate a vulnerability (Mean Time to Resolve).
• MTTD_текущая—the current average time to detect a vulnerability (Mean Time to Detect).
• MTTR_медианная—the median time to remediate vulnerabilities across all projects.
• MTTD_медианная—the median time to detect vulnerabilities across all projects.

The L coefficient reflects how defect processing time deviates from the median values:

• L < 1 means that the project remediates and detects vulnerabilities faster than the median;
• L = 1 corresponds to the median level;
• L > 1 means that the project processes vulnerabilities more slowly than the median.

Other indicators

Fixed Vulnerabilities

This indicator is calculated as the ratio of the number of closed vulnerabilities to the total number of vulnerabilities in the project.

Average time in a specific status

This indicator is calculated as the median time spent in each status, expressed as a whole number of hours.

Security Defect Lead Time

The Security Defect Lead Time value is calculated as the median defect lifetime, that is, from the New status to any closed status, for example, Fixed.

Mean Time to Detect (MTTD)

This indicator is calculated as the median time to identify defects in the project or projects. Defect identification means changing the status from New to any subsequent status.

Mean Time to Resolve (MTTR)

This indicator is calculated as the median time from an open status other than New to a closed status.