{"meta":{"title":"Metrics for Dependabot alerts","intro":"Use metrics to track and prioritize Dependabot alerts across your organization.","product":"Security and code quality","breadcrumbs":[{"href":"/en/code-security","title":"Security and code quality"},{"href":"/en/code-security/concepts","title":"Concepts"},{"href":"/en/code-security/concepts/supply-chain-security","title":"Supply chain security"},{"href":"/en/code-security/concepts/supply-chain-security/dependabot-alert-metrics","title":"Dependabot alert metrics"}],"documentType":"article"},"body":"# Metrics for Dependabot alerts\n\nUse metrics to track and prioritize Dependabot alerts across your organization.\n\nMetrics for Dependabot alerts help you understand the security posture of your organization's dependencies and track progress in resolving vulnerabilities. You can use these metrics to prioritize remediation efforts and focus on the most critical security issues.\n\nMetrics for Dependabot alerts are available on your organization's security overview.\n\n## Who can view metrics\n\nYou can see Dependabot metrics if you have one of the permissions mentioned in the \"Who can use this feature?\" box at the top of the article.\n\n## Ways the data can help you\n\nThe available metrics combine severity, exploitability, and patch availability to help you:\n\n* **Prioritize alerts**: Focus on the most critical vulnerabilities that need immediate attention based on severity, exploitability scores, and patch availability.\n* **Track remediation progress**: Monitor how quickly your organization resolves vulnerabilities and identify trends over time.\n* **Identify high-risk dependencies**: Quickly spot packages that pose the greatest security risk across your repositories.\n* **Make data-driven decisions**: Allocate resources effectively by understanding which repositories and vulnerabilities require the most attention.\n\nThese metrics help both application security managers measure the effectiveness of their vulnerability management programs and developers identify which vulnerabilities they can fix immediately.\n\n## Alert prioritization\n\nThe metrics dashboard shows the number of **open Dependabot alerts**. You can use filters such as availability of patches, severity, and EPSS score to narrow down the list of alerts to those matching specific criteria. See [Dependabot dashboard view filters](/en/code-security/how-tos/manage-security-alerts/remediate-alerts-at-scale/filtering-alerts-in-security-overview).\n\nFor more information about how AppSec managers can best use these metrics to optimize alert fixing, see [Prioritizing Dependabot alerts using metrics](/en/code-security/tutorials/manage-security-alerts/prioritizing-dependabot-alerts-using-metrics).\n\nKey metrics for prioritization include:\n\n* **Severity**: The impact level of a vulnerability (critical, high, medium, or low)\n* **Exploitability**: How easily a vulnerability can be exploited in practice, including EPSS scores\n* **Dependency relationship**: Whether the vulnerable dependency is direct or transitive (indirect)\n* **Dependency scope**: Whether the vulnerability affects runtime dependencies, development dependencies, or both\n* **Actual usage**: Whether the vulnerable code is actually used in your application\n* **Patch availability**: Whether a fix is available for the vulnerability\n\n## Alert resolution tracking\n\nYou can monitor how your organization resolves Dependabot alerts over time. Alert resolution metrics show the number of alerts:\n\n* Fixed by Dependabot\n* Manually dismissed\n* Auto-dismissed\n\nThis tile also displays the percent increase in the number of alerts closed in the last 30 days, providing visibility into remediation performance and helping you identify trends in vulnerability remediation.\n\n## Highest-risk packages\n\nThe \"Most vulnerabilities\" tile shows the dependency that has the most vulnerabilities in your organization, along with a link to the related alerts across all your repositories. This helps you quickly identify which dependencies pose the greatest risk.\n\n## Repository-level metrics\n\nThe repository breakdown table shows a summary of open alerts by repository, including:\n\n* The total number of alerts per repository\n* Severity distribution (critical, high, medium, low)\n* Exploitability information (for example, EPSS > 1%)\n\nThis table can be sorted by each column, helping you identify which repositories are most at risk and prioritize remediation efforts accordingly.\n\n## Further reading\n\n* [Viewing metrics for Dependabot alerts](/en/code-security/how-tos/view-and-interpret-data/analyze-organization-data/viewing-metrics-for-dependabot-alerts)\n* [Prioritizing Dependabot alerts using metrics](/en/code-security/tutorials/manage-security-alerts/prioritizing-dependabot-alerts-using-metrics)"}