Posture score
The Posture tab of the Reports page answers “are we making progress?” with a single figure: the share of points earned out of the points available. Next to it: the points behind that figure, its change since the end of the previous week, where the points come from, and the actions that earn the most. No gauge, no ring: one figure, one change, one breakdown.
The tab is open on every plan, to anyone who can read the cases of a project in the organization. The scope is the active project, or every project of the organization you can read.
How points are computed
Section titled “How points are computed”Each case (a vulnerability in a project) is worth points according to its decision tier, never according to the CVSS score alone:
| Tier | Points |
|---|---|
| 3 days | 10 |
| 14 days | 6 |
| 60 days | 3 |
| Deferred | 1 |
Points earned are a share of that maximum, according to the case status (partial credit):
| Status | Credit |
|---|---|
| Fixed, Not applicable | 100% |
| Mitigated | 75% |
| Risk accepted | 50% |
| Fixing | 25% |
| To triage, Analyzing | 0% |
A justified decision counts: mitigating a vulnerability or accepting a risk, with its justification and end date, earns points. An exception whose end date has passed earns nothing until it is renewed or lifted.
The scope covers open, mitigated and accepted cases, and cases closed less than 90 days ago. Without that window, years of fixed cases would push the score up on their own.
Score = points earned ÷ points available. It is compared with the end of the previous week (Monday 00:00, Paris time) and the change is written in points.
Actions that earn the most
Section titled “Actions that earn the most”The list shows, for each case that does not have its full credit, the possible gain (maximum minus earned), the tier, the status and the deadline. One click opens the case. The most rewarding cases come first, then the nearest deadline.
Week by week
Section titled “Week by week”The table of the last twelve weeks gives the score at the end of each week. The history is replayed from the case history: it is available from day one. Two approximations: exposure, automatability and impact are today’s (only the entry into the KEV catalog is dated), and a case’s deadline is today’s.
Outcome indicators
Section titled “Outcome indicators”Three outcomes are assessed every week, never a number of sign-ins:
- no KEV open for more than 7 days;
- no missed deadline;
- every new case triaged within 7 days (no case “To triage” for more than 7 days).
The streak counts the weeks met in a row (“6 weeks in a row with no KEV open for more than 7 days”). Tolerance: one missed week out of eight does not break the streak; it does not count either. Two missed weeks in the same window break it. Weeks before the first project are “not applicable”: a zero without monitoring is worth nothing.
Frozen weeks
Section titled “Frozen weeks”An administrator of the organization can freeze an upcoming week (year-end closure, change freeze): it counts neither as met nor as missed. Four freezes at most over 52 weeks, always set in advance: a past week cannot be frozen afterwards. An upcoming freeze can be lifted at any time. Each freeze is recorded in the audit log and included in the organization’s full export.