About the Security Posture Rating Report
The SPR report helps you understand how vulnerability response activities impact your security posture and its criticality to successful risk management. As critical vulnerabilities are remediated, the SPR is automatically adjusted to show your new overall risk. Because it is calculated by intelligent asset groupings, when an asset’s vulnerabilities are remediated, the overall security posture improves. The SPR (Security Posture Rating) report reflects your organization’s attack surface and cyber risk, analyzing your security posture rating over time.
Use the Filters pane on the right to focus your report, click on a specific data element to filter the entire report or to access more data, and hover over a widget for more actions and info.
Before you dive in
First, make sure you cover the Report (Analytics) Filters and Data Drilling to learn about the expected behavior of the trends and the presented data.
KPIs
The Risk KPIs are the first and main widgets you encounter when entering the SPR report.
What does each KPI represent?
KPI | Description | What to strive for? |
Security Posture Rating (SPR) | Percentage of assets with a maximum risk score below the defined SPR risk threshold, i.e., the percentage of assets that comply with your security posture policy. This KPI also indicates the % of positive (in green), negative (in red), or neutral (in grey) stats change compared to previous periods.
| The higher the SPR is, the more compliant your environment is with the organization's security posture. |
Risk Mass | The lower the Risk Mass is, the better. Decreasing Risk Mask indicates that the sum of all the calculated atomic risks of all findings (instances) has lessened. | |
Findings (instances) | Count of all the findings (instances) in the organization. This KPI also indicates the percentage of positive (in green), negative (in red), or neutral (in grey) stats change compared to previous periods. | - |
Widgets and trends
Most SPR Compliant Business Groups
A list of most SPR-compliant business groups and their shift in rank (Current vs. Previous Rank). For a Business Group to be compliant, its assets' maximum risk score must be below the defined SPR risk threshold. The higher the SPR, the more compliant the Business group is.
Most SPR Vulnerable Business Groups
A list of the most vulnerable business groups and their shift in rank (Current vs. Previous Rank). For a Business Group to be vulnerable and get a high vulnerability rank, its count of findings (instances) must be higher than the other business groups. Pay attention to high-impact Business groups with a high count of findings (instances).
SPR over time
Percentage of assets with a maximum risk score below the defined SPR risk threshold over time, i.e., the percentage of assets that comply with your security posture policy and change in % over time. You can use the data-drilling buttons to explore the data further.
Note: When the retrieved vulnerability CVSS score is either 0, undefined or falls outside the valid range (a float between 0 and 10), Vulcan Cyber ExposureOS retrieves the CVSS score from the cloud. In instances where both cloud and native sources lack a CVSS score, a default value of 0 is applied.
Attack Surface Report
Use the attack surface report to learn about the risk changes on assets that affected the SPR changes you observed over time. Read more here on the Attack Surface Report feature.
Unique Vulnerabilities by Highest Risk Mass
A list of the top 13 Unique Vulnerabilities and their Risk Mass, sorted by the highest risk mass to the lowest. The risk mass of a unique vulnerability = the risk mass sum of all findings (instances).
Selected KPIs over time
A view of the SPR KPIs over time. Select/unselect Vulnerabilities, Assets, and Risk Mass to focus on a single trend or all three trends in correlation over time. Data-drill-down buttons allow deeper views into the data.
Findings (Instances) by Risk Level
Percentage of findings (instances) by Risk Level (None, Low, Medium, High, and Critical).
Findings (instances) by Risk Level over time
Percentage of findings (instances) by Risk Level (None, Low, Medium, High, and Critical) over time. Data-drill-down buttons allow deeper views into the data.
SPR by Asset Type
Percentage of SPR compliance by asset type (Cloud, Host, Code Project, Website, and Image).
SPR by Asset Type over time
View the percentage of SPR per asset type over time (Cloud, Host, Code Project, Website, and Image). Use the data-drilling buttons to explore the data further.
Asset Compliant with EOL by OS and Risk Level
Percentage of assets compliant with their EOL date by OS and Risk Level.
Assets Reached EOL by Risk Level over time
Count of assets that reached their EOL date over time by risk level.
Reports (Analytics) FAQ and Data Validation
Read our Reports (Analytics) FAQ and Data Validation article here.