Alerts closed this quarter is the wrong board number.
Most cybersecurity board reporting for cloud shows two numbers: alerts detected and alerts closed this quarter. Both can rise together, and neither tells the board whether the company is more or less exposed. Tamnoon's State of Cloud Remediation 2026 puts the board-relevant number plainly: open alerts on Crown Jewel assets, by age range. This post explains why, and what to put on one page, including the budget line that most decks leave out.
The report measured 14.86 million CNAPP detections. As of May 2026, 53% of them were still open. That share has held between 40% and 50% for years, even though closure rates improved. Closure rates rose and the open pile did not shrink, because the easy alerts get closed first and what remains is harder.
So a closure-rate chart that climbs tells the board the team is busy. It does not tell them that critical alerts take 150 days from open to close, up from under 40 days in 2024, or that Vulnerability Management closes in 282 days. The report's words: closure-rate dashboards understate this, and age-based reports surface it.
Open alerts on Crown Jewel assets, by age range, with the trend.
Four choices are built into that line.
Open, not closed. Active risk lives in the open backlog and should be reported there. An alert that was closed last quarter is not a risk this quarter.
Crown Jewel, not severity. CNAPP severity classifications are inconsistent across vendors. Asset criticality is defined by the business, not by the scanner. In the dataset, 6.3% of open alerts touch a Crown Jewel asset. That slice is the part a board can reason about, because the board already knows which systems carry revenue, regulated data, customer trust or the licence to operate.
By age, not by count. An open alert that is 10 days old and one that is 200 days old are different risks. Age ranges show the long tail that a total hides.
With the trend, not a snapshot. The same four age bands last quarter, next to this quarter's. The question the board is really asking is whether exposure is falling while intake rises.
Our recommendation, built on the report's framing.
| Row | What the board sees | Why |
| Open alerts on Crown Jewel assets | Count, split into under 30 days, 30 to 90, 90 to 180, over 180 | The exposure that matters, by how long it has existed |
| Trend | The same four bands last quarter | Whether exposure is falling while intake rises |
| Slowest categories | The three with the longest close times and their named owner | Where coordination is stuck |
| Intake | Share of new alerts tagged critical | The queue is changing shape: 1.4% in 2025, around 13% in 2026. The report notes part of that rise reflects expanded coverage and changed severity logic across CNAPPs |
Keep severity off the page except as a footnote. Severity is useful for routing inside the security team. Detection alone cannot deliver an accurate view of risk the way remediation prioritized by asset value can.
The report's third point for leaders: coordination is the invisible budget line costing you as long as nobody owns it. Faster scanners, more analysts, AI-assisted triage and bigger dashboards all address technical throughput. None address the coordination layer where most close-time elapses.
Map the org chart for a single open privacy finding and it touches cloud security, application engineering, legal, vendor management and sometimes finance. No team owns the end-to-end closure timeline. The three slowest categories in the dataset, Vulnerability Management at 282 days, Privacy Regulations at 242 days and Password Management at 242 days, are slow because each one crosses teams and ownership paths that no CNAPP controls, and vulnerabilities also wait on vendor patch windows.
The report found that programs that closed the gap, including every category in the dataset where close times fell, did so by making coordination an explicit practice, owned and resourced. For the board, that is a line for an owned coordination practice, whether a named internal team or a remediation partner that owns closure end to end. Put it on the page as such.
The report's self-assessment. If the team cannot answer these in under five minutes, the data does not live where it should.
The coordination line on that page is the one Tamnoon exists to own. Tamnoon takes ownership of closing what your CNAPP finds, prioritized by the asset rather than the severity tag, and is accountable for production still working afterwards. The decision record holds the same facts a board page needs: what was open, on which asset, for how long, what closed the finding, and what was declined and why.
Open alerts on Crown Jewel assets by age range, the trend, the slowest categories with their owners, and the share of new alerts tagged critical. Closure counts belong in an appendix.
Because the open share has held between 40% and 50% for years while closure rates rose. Closing more does not mean exposure fell.
By the business: the systems that carry revenue, regulated data or customer trust, identified through metadata and asset tags, or by architecture review. The scanner's severity tag is not a substitute.
The dataset average is 150 days for critical alerts and 282 days for Vulnerability Management. Show your own numbers next to those and the trend, rather than a target the team has never met.
Quarterly is enough for the trend to mean something, with the same four age bands each time so the bands can be compared. A monthly version belongs with the security leadership team, not the board.
The full self-assessment and the category close times are in the State of Cloud Remediation 2026. The one-page layout is our recommendation.
Teardowns, CTF write-ups and field notes from the people who close cloud findings for a living.
You're subscribed.
That did not go through. Try again in a minute.
At most one email a month. Unsubscribe from any of them.
