Vulnerability Remediation Sankey Diagram: Scan to Fix
Follow security findings from the scan that found them to their severity and to the outcome: fixed in SLA, fixed late, accepted, false positive or open. Replace the sample counts with your own.
A vulnerability remediation Sankey shows where findings come from, how severe they are and how they end. It separates findings fixed on time from the ones that are late, accepted or simply open.
The example has 250 findings from four sources: dependency scans, code scans, container image scans and a penetration test. They are sorted into critical, high, medium and low severity. The last column has five outcomes: fixed within the SLA, fixed late, risk accepted, false positive and still open.
The picture answers a question a dashboard total does not: 15 of 20 critical findings were fixed within the SLA, but a third of the low findings were accepted instead of fixed. That is a policy result, not a failure. For the process behind it, see /templates/vulnerability-management-process, and /guides/how-to-triage-vulnerabilities-and-track-remediation for the method.
How to read this diagram
- Of 250 findings, 115 (46%) were fixed within the SLA and 46 (18%) were fixed late.
- 15 of 20 critical findings (75%) met the SLA; 1 is still open.
- Accepted risk is 38 findings (15%), and 25 of them are low severity.
- Dependency scans produce 120 findings, 48% of the total.
The data behind it
Invented figures for illustration. Not data about any real company, team or system.
| From | To | Amount (findings) |
|---|---|---|
| Dependency scan | Critical | 10 |
| Dependency scan | High | 30 |
| Dependency scan | Medium | 50 |
| Dependency scan | Low | 30 |
| Code scan | Critical | 3 |
| Code scan | High | 10 |
| Code scan | Medium | 25 |
| Code scan | Low | 22 |
| Container image scan | Critical | 6 |
| Container image scan | High | 12 |
| Container image scan | Medium | 19 |
| Container image scan | Low | 13 |
| Penetration test | Critical | 1 |
| Penetration test | High | 3 |
| Penetration test | Medium | 6 |
| Penetration test | Low | 10 |
| Critical | Fixed within SLA | 15 |
| Critical | Fixed late | 4 |
| Critical | Still open | 1 |
| High | Fixed within SLA | 35 |
| High | Fixed late | 12 |
| High | Risk accepted | 3 |
| High | False positive | 2 |
| High | Still open | 3 |
| Medium | Fixed within SLA | 45 |
| Medium | Fixed late | 20 |
| Medium | Risk accepted | 10 |
| Medium | False positive | 8 |
| Medium | Still open | 17 |
| Low | Fixed within SLA | 20 |
| Low | Fixed late | 10 |
| Low | Risk accepted | 25 |
| Low | False positive | 10 |
| Low | Still open | 10 |
The same data as CSV
source,target,value
Dependency scan,Critical,10
Dependency scan,High,30
Dependency scan,Medium,50
Dependency scan,Low,30
Code scan,Critical,3
Code scan,High,10
Code scan,Medium,25
Code scan,Low,22
Container image scan,Critical,6
Container image scan,High,12
Container image scan,Medium,19
Container image scan,Low,13
Penetration test,Critical,1
Penetration test,High,3
Penetration test,Medium,6
Penetration test,Low,10
Critical,Fixed within SLA,15
Critical,Fixed late,4
Critical,Still open,1
High,Fixed within SLA,35
High,Fixed late,12
High,Risk accepted,3
High,False positive,2
High,Still open,3
Medium,Fixed within SLA,45
Medium,Fixed late,20
Medium,Risk accepted,10
Medium,False positive,8
Medium,Still open,17
Low,Fixed within SLA,20
Low,Fixed late,10
Low,Risk accepted,25
Low,False positive,10
Low,Still open,10How it works
Export findings for one period
Include the source tool, severity and the current state, including the date fixed.
Fix the outcome labels first
Decide how to tell fixed within SLA from fixed late, and what counts as accepted or false positive.
Count source to severity to outcome
Count each finding once, after de-duplicating the same issue reported by two tools.
Check the balance
Each severity must leave as many findings as entered.
Frequently asked questions
Is this a risk score?
No. It counts findings and does not weigh them by exploitability or asset value. Use it to see the shape of the work, then use your risk process to decide what matters.
Can it prove compliance?
No. It is an illustration of one period's counts. Evidence for an audit comes from your ticketing and scanning records.
Edit this vulnerability Sankey
Open the example as your own chart and enter your finding counts.