---
title: Vulnerability Management CISO dashboard
description: With the Vulnerability Management CISO dashboard, view data such as Key Performance Metrics \(KPIs\) for vulnerability remediation, see the highest risks, verify scan coverage, and learn how to lower risks.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/vulnerability-mgmnt-CISO-dashboard.html
release: australia
product: Vulnerability Response
classification: vulnerability-response
topic_type: concept
last_updated: "2026-03-12"
reading_time_minutes: 9
breadcrumb: [Platform Analytics Solutions for Vulnerability Management, Analytics and Reporting Solutions for Vulnerability Response, Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Vulnerability Management CISO dashboard

With the Vulnerability Management CISO dashboard, view data such as Key Performance Metrics \(KPIs\) for vulnerability remediation, see the highest risks, verify scan coverage, and learn how to lower risks.

## Required ServiceNow AI Platform roles

-   sn\_vul.vulnerability\_ciso to view the dashboard.
-   sn\_vul.ciso\_write to edit the dashboard.

## Activating the CISO dashboard

To activate the CISO dashboard, you must install Performance Analytics for Vulnerability Response and activate the corresponding Performance Analytics job. For more information, see [Analytics and Reporting Solutions for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vulnerability-mgmnt-content-pack.md).

## Use cases

<table id="table_s3y_dny_3pb"><thead><tr><th>

User

</th><th>

Dashboard use

</th></tr></thead><tbody><tr><td>

Chief Information Security Officers \(CISOs\)

</td><td>

Chief Information Security Officers \(CISOs\) can use the CISO dashboard to gain insight into the vulnerability management program for their organizations. The dashboard provides data to help them identify data at-a-glance how they can use to lower the vulnerabilities to their environments.

</td></tr></tbody>
</table>## Using the CISO dashboard

Executive users, like the Chief Information Security Officers \(CISOs\) in your organization, can view the CISO dashboard for Vulnerability Response to understand how effective their vulnerability management program is. You can view the CISO dashboard by navigating to **Vulnerability Response** &gt; **CISO Dashboard**. Use the top-level filters to filter reports by Risk Rating, Age Range, or Internet Facing. Some reports display trending data over a period of time. You can view how the important metrics are trending on a regular basis, analyze the overall business security risk, and identify the areas that need improvement.

Starting with version 19.0 of Vulnerability Response, this dashboard can also be viewed in the New Experience UI. To view the dashboard in the new UI, navigate to **Workspaces** &gt; **Vulnerability Manager Workspace** and click the **Dashboards** icon. Depending on your role, the default dashboard is displayed. To view other dashboards, click the drop-down next to the dashboard name. For more information, see [Dashboards in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-manager-workspace/vr-ws-dashboards.md) and [Dashboards in the IT Remediation Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/it-remediation-workspace/itr-ws-dashboards.md).

**Note:** If you are on Tokyo, you can view the dashboards in the Next Experience UI but with some functional loss.

## Running the scheduled jobs

Run the scheduled jobs in this order to update the data in the reports:

1.  Update dashboard tables
2.  \[PA VR\] CISO Dashboard

<table id="table_kkp_z5m_n4b"><thead><tr><th>

Scheduled job name

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Update dashboard tables

</td><td>

Daily scheduled job that you must run before the \[PA VR\] CISO Dashboard job so that you can collect the CISO data. By running this scheduled job, you update the Scan Coverage reports. The information updated includes the operational configuration items \(CIs\) that are scanned in the last 90 days, their classes, and the total number of operational CIs that correspond to these classes. Running this scheduled job updates the reports in the **Recommended Actions** tab as well.

 **Note:** Operational CIs refer to the CIs that have an operational status as `Operational`.

</td></tr><tr><td>

\[PA VR\] CISO Dashboard

</td><td>

After the Update dashboard tables scheduled job is complete, run this scheduled job to populate all the reports in the **CISO Overview** tab.

</td></tr></tbody>
</table>## CISO dashboard tabs

This dashboard provides an insight into the risks present in Vulnerability Management. You can view vulnerabilities and their related data by region, age, services, and other breakdowns.

The Overview tab contains reports that provide the security posture of your organization at a glance.

\[Omitted image "ciso-overview.jpg"\] Alt text: CISO overview tab

**Note:** The top-level filter can only be used for some reports.

The Recommended Actions tab contains reports that provide insights into exploitable, aging, and prevalent vulnerabilities. It also contains solutions that recommend actions to reduce the risks. Run the **Update CISO dashboard tables** scheduled job to update the reports in this tab.

\[Omitted image "ciso-recommended-actions.jpg"\] Alt text: CISO recommended actions tab

## Indicators

To view the indicators, navigate to **Performance Analytics** &gt; **Indicators**.

1.  On the Indicators page, search for the required indicator name in the Name column.
2.  Click the indicator name to open the record and view its details.

    The indicators for the CISO dashboard do not collect records by default. You can choose to collect records by selecting the Collect records check box.


-   **Total Duration of Closed Vulnerable Items**

    Total Duration of Closed VIs is measured daily as Days. The goal of this indicator is to minimize the score.

-   **Scannable Assets**

    Scanned Assets is measured daily as unit \#. The goal of this indicator is to maximize the score.

-   **Services with Most Vulnerabilities**

    Services with Most Vulnerabilities is measured daily as unit \#. The goal of this indicator is to minimize the score.

-   **Average Vulnerabilities per Asset**

    \[\[Active Vulnerable Items\]\] / \[\[Active Vulnerable Configuration Items\]

-   **Closed Vulnerable Items**

    Closed Vulnerable Items is measured daily as unit \#. The goal of this indicator is to maximize the score.

-   **Vulnerable Items Mean Time to Remediate**

    \[\[Summed Duration of Closed Vulnerable Items\]\] / \[\[Closed Vulnerable Items\]\]

-   **Current Scan Coverage**

    Calculates the current scan coverage as percentage.

-   **Scanned Assets**

    Scanned Assets is measured daily as unit \#. The goal of this indicator is to maximize the score.

-   **Closed Vulnerable Items \(Target Met\)**

    Closed Vulnerable Items \(Target Met\) is measured daily as unit \#. The goal of this indicator is to maximize the score.

-   **% of Closed Vulnerable Items that Met Target**

    \[\[Closed Vulnerable Items \(Target Met\) / By month SUM\]\] / \[\[Closed Vulnerable Items / By month SUM\]\] \*100

-   **Active Vulnerable Items**

    Active Vulnerable Items is measured daily as unit \#. The goal of this indicator is to minimize the score.

-   **Average Age of Vulnerable Items**

    Average Age of Active VIs is measured daily as unit Days. The goal of this indicator is to minimize the score.

    **Note:** Customizing the Age and Age closed calculation for vulnerable items \(VIs\) may lead to a sharp rise or drop in the Performance Analytics \(PA\) reports that include these metrics. For more information on how to customize the calculation of Age and Age closed for VIs, see the [KB1703270](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1703270) KB article.

-   **Active Vulnerable Configuration Items**

    Active Vulnerable CIs is measured daily as unit \#. The goal of this indicator is to minimize the score.

-   **Monthly Remediation Efficiency**

    \[Number of vulnerable items closed during a month\] / \[Number of new or reopened vulnerable items in the same month\]

-   **New Vulnerable Items**

    New Vulnerable Items is measured daily as unit \#. The goal of this indicator is to minimize the score.

-   **Deferred Vulnerable Items**

    Deferred VIs is measured daily as unit \#. The goal of this indicator is to minimize the score.


## Breakdowns

-   Assignment Group: Applies to some VI reports.
-   Risk Rating: Applies to VI reports.
-   Age Range: Applies to VI reports.
-   Age Closed: Applies to reports for closed VIs.
-   Internet Facing: Indicates whether the CI belongs to the hardware class and is internet facing.
-   Region: The CMDB CI parameter used is Location. This location indicates the country of origin of the configuration item.

**Note:** Customizing the Age and Age closed calculation for vulnerable items \(VIs\) may lead to a sharp rise or drop in the Performance Analytics \(PA\) reports that include these metrics. For more information on how to customize the calculation of Age and Age closed for VIs, see the [KB1703270](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1703270) KB article.

## Data visualizations

<table id="table_y4z_x4p_h2b"><thead><tr><th>

Name

</th><th>

Type

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Average Vulnerabilities per Asset

</td><td>

Single Score \[Omitted image "single-score.png"\] Alt text: Single-score icon

</td><td>

Average number of active vulnerable items for each configuration item.

</td></tr><tr><td>

Mean Time to Remediate \(MTTR\)

</td><td>

Single Score \[Omitted image "single-score.png"\] Alt text: Single-score icon

</td><td>

The mean time to remediate \(close\) a vulnerable item, displayed as a 30-day running average.**Note:** The value for Age Closed is calculated when data is collected. The value is the difference between the Last Opened date and the date and time of the collection job.

</td></tr><tr><td>

Average Age of Vulnerabilities

</td><td>

Single Score \[Omitted image "single-score.png"\] Alt text: Single-score icon

</td><td>

Average age of active vulnerable items in days.

</td></tr><tr><td>

Services with Most Vulnerabilities

</td><td>

List and Line\[Omitted image "scorecard-icon.png"\] Alt text: List icon3 \[Omitted image "line-icon.png"\] Alt text: Line icon

</td><td>

Monthly average of active vulnerable items for services in the organization.**Note:** For information on defining the service classifications that you want to display in Vulnerability Response reporting and related lists, see the Services tab in [Vulnerability Management \[PA\] dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vulnerability-mgmnt-pa-dashboard.md).

</td></tr><tr><td>

Countries with Most Vulnerabilities

</td><td>

Donut\[Omitted image "donut-icon.png"\] Alt text: donut report icon

</td><td>

Top 10 countries with the highest number of vulnerable items.

</td></tr><tr><td>

Monthly Remediation Efficiency

</td><td>

Single Score \[Omitted image "single-score.png"\] Alt text: Single-score icon

</td><td>

Percentage of closed vulnerable items divided by new vulnerable items in the current month.

</td></tr><tr><td>

New and Closed Vulnerable Items

</td><td>

Bar \[Omitted image "column-icon.png"\] Alt text: Bar icon

</td><td>

Number of new vulnerable items imported and number of vulnerable items closed in a month.

</td></tr><tr><td>

Scan Coverage

</td><td>

Line\[Omitted image "line-icon.png"\] Alt text: Line icon

</td><td>

Number of scanned assets compared to the total number of scannable assets, shown over time. The CI Classes included in the widget are specified in the Scan Coverage Configuration module.For information on configuring the Scan Coverage module, see [Configure the Scan Coverage reports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/ciso-add-ci-class-to-scan-coverage-report.md).

</td></tr><tr><td>

Monthly Scan Coverage

</td><td>

Single Score \[Omitted image "single-score.png"\] Alt text: Single-score icon

</td><td>

Percentage of scanned assets divided by the total number of scannable assets for the current month. For information on configuring the Scan Coverage module, see [Configure the Scan Coverage reports](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/ciso-add-ci-class-to-scan-coverage-report.md)

</td></tr><tr><td>

Top 10 Assignment Groups with Most Deferred Vulnerabilities

</td><td>

List and Line\[Omitted image "scorecard-icon.png"\] Alt text: List icon3 \[Omitted image "line-icon.png"\] Alt text: Line icon

</td><td>

Top 10 assignment groups with the highest number of deferred vulnerable items, deferred based on the monthly average.

</td></tr><tr><td>

Top 10 Assignment Groups with Lowest Remediation Target Adherence

</td><td>

List and Line\[Omitted image "scorecard-icon.png"\] Alt text: List icon3 \[Omitted image "line-icon.png"\] Alt text: Line icon

</td><td>

Top 10 assignment groups whose vulnerable items have the lowest adherence to their remediation targets.

</td></tr></tbody>
</table>|Name|Type|Source table|Description|
|----|----|------------|-----------|
|Top 10 Vulnerabilities with Exploits Available|List\[Omitted image "scorecard-icon.png"\] Alt text: List icon3|Vulnerability Top Item \[sn\_vul\_analytics\_top\_item\]|Active vulnerabilities with exploits available for all the threat intelligence vendors that use the VR exploit framework.|
|Top 10 Highest Impact Solutions|List\[Omitted image "scorecard-icon.png"\] Alt text: List icon3|Vulnerability Top Item \[sn\_vul\_analytics\_top\_item\]|Preferred solutions or patches with the highest risk scores for active vulnerable items. This report uses the capabilities of Vulnerability Solution Management \(VSM\), which correlates patches from Microsoft and Red Hat to vulnerabilities in the environment. VSM helps identify the preferred solution for vulnerabilities.|
|Top 10 Oldest Vulnerable Items|List\[Omitted image "scorecard-icon.png"\] Alt text: List icon3|Vulnerability Top Item \[sn\_vul\_analytics\_top\_item\]|Active vulnerable items with the highest age. Resolve these items to lower the average vulnerability age on the Overview tab.|
|Top 10 Vulnerabilities Most Prevalent on Assets|List\[Omitted image "scorecard-icon.png"\] Alt text: List icon3|Vulnerability Top Item \[sn\_vul\_analytics\_top\_item\]|Active vulnerable items available for the highest number of assets.|