Show the count, and the period beside it
An SLA breach count means nothing alone. Eleven breaches is a crisis for a client with forty tickets and noise for one with four hundred. Put the count beside the previous period and beside the ticket volume for both, and the number explains itself.
Resist the percentage unless the client already thinks in it. A breach rate invites a debate about the denominator, and the denominator is the one thing on the page the client cannot verify from their side.
Name what the count cannot prove
A rise in breaches does not, by itself, show worse service. It can show a stricter SLA, a change in how tickets are classified, a single bad week, or a client-side change that generated a burst of urgent tickets. A fall can show the reverse of any of those.
Say this on the page, in the data-gaps section, before the meeting. A client who reads it there hears an advisor being careful. A client who raises it in the room and gets a defensive answer hears a vendor being caught.
Turn the number into a decision
The question is never whether the count is bad. It is what to do next quarter, and there are only a few candidate answers: change the SLA target, change the escalation path, change the client-side process that generates the tickets, or accept the level and stop discussing it.
Put the candidate you recommend on the page as a decision request with an owner. If the breaches cluster around one system or one site, the decision is narrower and easier to agree. If they do not cluster, say so; that is a finding too.
When the quarter was genuinely bad
Lead with it. A headline that says breaches rose and asks for an escalation review reads as control. A headline about patch compliance with the breach number buried in finding three reads as spin, and the client will find it.
Then show the other metrics honestly. If backup success and patch coverage held, say so; the client is deciding whether the relationship is working, not grading a single line.
Keep the definition stable
The most common cause of a QBR argument about breaches is that the number was counted differently this quarter. Write down what counts as a breach, which boards it is counted on, and whether paused time is excluded. Use the same definition every period, and the conversation stays on the service instead of on the arithmetic.
If the definition has to change, change it at a quarter boundary, say so on the page, and show the previous period restated under the new rule. A client can accept a new yardstick; what they cannot accept is discovering one halfway through a comparison.