About Security Posture Rating Report

The SPR (Security Posture Rating) Analytics report reflects your organization’s attack surface and cyber risk, analyzing the security posture rating progress over time.

Before you dive in

First, make sure you cover the Analytics Filters and Data Drilling to learn about the expected behavior of the trends and presented data.

Risk KPIs

The Risk KPIs are the first and main widgets you encounter when entering the SPR Analytics report.

What each KPI represents?

KPI	Description	What to strive for?
Security Posture Rating	The current % of assets with maximum risk score below the configured SPR score and how it changed in % compared to the previous period.	The higher the SPR is, the more compliant your environment is with the organization's security posture.
Risk Mass	The current Risk Mass and how it changed in % when compared to the previous period	The lower the Risk Mass is, the better. Decreasing Risk Mask indicates that the sum of all the calculated atomic risks of all vulnerability instances has lessened.
# of Vulnerability Instances	The count of all vulnerability instances and the % of change compared to the previous period	-

Most Compliant Business Groups

Look at your most compliant business groups and how their rank shifts (Current vs. Previous Rank). For a Business Group to be compliant, its SPR has to be above the SPR threshold and as high as possible. The higher the SPR, the more compliant the Biz group is.

Let's look at the example below, assuming we've set the Period filter to compare the "Last 30 Days" with the 30 days before it:

The RND QA Biz Group climbed from rank 23 to 4 as its SPR rating improved over the past 60 days.
The Testing - External Biz Group kept its rank and hasn't changed in the past 60 days as its SPR stayed the same.
The Linux Team Biz Group decreased from 5 to 6 as its SPR decreased.

Most Vulnerable Business Groups

Look at your most vulnerable business groups and their shift in rank (Current vs. Previous Rank). For a business group to be considered as very vulnerable and get a high rank, its vulnerability instances must be higher than other business groups.

Let's look at the example below, assuming we've set the Period filter to compare the "Last 30 Days" with the 30 days before it:

The Linux Team Biz Group has the highest rank (#1) as it contains the largest number of vulnerability instances. In addition, its rank hasn't changed in the past 60 days because the number of vulnerability instances (401,282) hasn't changed.
The External Facing Biz Group has climbed up from rank 3 to 2. This is due to the increasing number of vulnerability instances in this group.
The Cloud-env External Biz Group went down in rank from 2 to 5 as the number of vulnerability instances in this group significantly decreased.

Security Posture Rating (SPR) over time

This trend shows the upwards and downwards shift of the SPR over time. You can use the data-drilling buttons to dig deeper into the data.

Note: When the retrieved vulnerability CVSS score is either 0, undefined, or falls outside the valid range (a float between 0 and 10), Vulcan retrieves the CVSS score from the cloud. In instances where both cloud and native sources lack a CVSS score, a default value of 0 is applied.

Attack Surface Report

Use the attack surface report to learn about the risk changes on assets that affected the SPR changes you observed over time. Read more here on the Attack Surface Report feature.

Vulnerabilities, Assets, and Risk Mass over time

This trend shows the number of Vulnerabilities, Assets, and Risk Mass over time. You can select to view a single trend or all of the three trends in correlation to each other.

You can use the data-drilling buttons to dig deeper into the data.

% of Vulnerability Instances by Risk Level

A straight-forward trend that shows the % of vulnerabilities existing per each risk level (None, Low, Medium, High, and Critical)

% of Vulnerability Instances by Risk Level over time

The % of vulnerabilities existing per each risk level over time. You can use the data-drilling buttons to dig deeper into the data.

SPR by Asset Type

View the % of SPR per asset type (Cloud, Host, Code Project, Website, and Image).

SPR by Asset Type over time

View the % of SPR per asset type over time (Cloud, Host, Code Project, Website, and Image). You can use the data-drilling buttons to dig deeper into the data.