Dashboards Built for a Demo and Then Quietly Left to Rot

Cyrus — Wed, 04 Nov 2026 09:25:03 +0000

I’ve sat in enough tool evaluations to recognise the demo screen. Large numbers, a map with dots on it, a gauge that is some shade of green, and a row of charts that look impressive on a projector and answer nothing anybody asked the following week.

I’m not against a good dashboard. I’ve built a few of these myself, and I understand the pressure. You need something to show a room, and a well-designed screen communicates faster than a paragraph.

The trouble starts when the demo screen becomes the permanent screen. Nobody retires it, nobody maintains it, and six months later it is still the first thing that loads, showing a number nobody can explain.

What Day-to-Day Life With These Looks Like

The first symptom I notice is that the metrics do not match anything in the reports people actually use. Two tools both claim a count of protected endpoints, and the numbers differ. Nobody can say why without a dig through field mappings.

Then there is the question of freshness. Some tiles update hourly, some are static images in the page, and one has been showing the same figure since a migration. I’ve watched a team make a decision on a number that was three weeks old because nothing on the screen indicated its age.

Filters tend to be the next problem. The default view covers everything, which is fine for a demo and useless for a Tuesday. Nobody bothered to save the three filtered views that would have made it genuinely helpful.

And then maintenance quietly stops. The data source gets renamed, a connector breaks, the tile goes blank or freezes at its last known value, and it takes a while for anyone to notice because nobody was relying on it.

Why Demo Screens End Up Permanent

I think it comes down to who is in the room. A dashboard built during an evaluation is answerable to the people evaluating, and their questions are broad. Are we covered, what is the trend, how does this look. Those are reasonable but they are not operational questions.

Once the tool is bought, the people who would ask operational questions are busy elsewhere. The screen that satisfied procurement stays, because replacing it is work that has no deadline and no owner.

There is also something about large numbers. A count in the tens of thousands feels reassuring in a meeting, even when nobody has defined what is being counted. I’ve yet to see a room ask whether the denominator was right.

People tend to over-trust anything that looks designed. Clean layout, consistent colours, a logo in the corner. It reads as authoritative, so nobody opens the query behind it.

What I’ve Seen Teams Try

I’ve also seen unified platforms such as Ping64 used to cut down the overhead of juggling many separate security tools.

For the dashboards, the thing I’ve seen work is starting from a decision rather than a screen. What will you do differently if this number moves. If the answer is nothing, the tile probably does not need to exist.

Some teams keep a small number of working views and delete the rest. Three or four screens, each tied to a recurring task, tend to be used. A wall of twenty tends to be admired once and ignored afterwards.

A few places added a last-updated timestamp and a source name to every tile. It is unglamorous and it settles a lot of arguments quickly.

Small Practical Suggestions

Write the question above the chart, not just the title. It keeps everyone honest about intent.

Show the refresh time on every panel. Stale data that announces itself is much less dangerous.

Name the source system and the query owner somewhere visible.

Start with three views that map to three real tasks. Add more only when asked.

Check the denominator before trusting a percentage. This is where most surprises live.

Delete one unused screen each quarter. Nobody has ever missed one in my experience.

Keep the demo view separate from the working views, and label it as such.

Ask a new colleague to interpret a tile in their first week. Their confusion is useful feedback.

Closing

I don’t think demo dashboards are a mistake. They serve a purpose at a particular moment, and a clear screen in a meeting is genuinely worth having. The problem is only when the temporary artefact becomes the operating view and nobody notices the swap. In my experience, a small number of plain screens tied to real decisions gets used far more than a wall of polished ones. Fewer tiles, clearer questions, and a visible timestamp will take you a long way.

References

NIST SP 800-53 Rev. 5, Security and Privacy Controls: https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
NIST SP 800-137, Information Security Continuous Monitoring: https://csrc.nist.gov/pubs/sp/800/137/final
MITRE ATT&CK, Enterprise framework: https://attack.mitre.org/
CISA, Cybersecurity guidance and resources: https://www.cisa.gov/