Pattern
What a findings dashboard leaves out
Counting open findings measures the discovery process. It says nothing about detection speed, containment, or recovery, and it falls when scanning stops. An executive dashboard should therefore show detection time, containment time, and demonstrated recovery, because a falling finding count does not show a safer company.
The pattern
Claim: recommendation
Report findings as an operational queue. On the executive view, show detection time, containment time, demonstrated recovery, the reach of the most privileged identity, and the share of controls checked by machines.
A falling finding count may show a tidier backlog. It does not show a safer company when detection time remains unknown.