Risk Posture
Risk Posture is the page where the organization states what matters and sees what the figures rest on. It has three tabs: Crown jewels, the systems whose compromise would matter most and the consequences stated for each; Compensating controls, what the organization states about an exposure with the evidence for it; and Evidence and coverage, what the modeled figures rest on and how complete the search was. The figures themselves, their history and their breakdown live on the Executive Risk Overview, and the remediation options and scenarios on the Remediation page. For what each figure means, read Modeled risk.
The page is organization-wide. Designating a crown jewel, stating an impact or a compensating control needs an organization administrator, engineer or pentester; every other role reads.
SCREENSHOT: the Risk Posture page on its Crown jewels tab.
The header
The header names the model version the figures were computed under, the horizon, when the figures were computed and whether coverage is complete, and links to the executive overview where the figures are shown. The Modeled badge says what every number on the risk pages is: modeled from the attack paths, under a named version, never a calibrated likelihood and never your overall risk.
Crown jewels
The tab lists every crown jewel the organization designated: its name, kind, the thing it names or the members it is made of, its business criticality, business unit and status, the impacts stated on it, and, from the current snapshot, how many entries reach it, on which rung, the modeled compromise and the financial figure. A jewel the snapshot has not placed yet says so in place of its figures.
Designate opens the form. A jewel is an application, an asset, an identity, a data set or a business process, with a name, an optional owner, description and business unit, and a business criticality of your choosing. An application is a kind of its own and is found by name; an asset by its type and name; an identity by its directory and id. A data set or a process is declared from its members, each an application, an asset or an identity, and names no target of its own. Edit restates a jewel; its kind and what it names never change, because a different thing is a different jewel. Retire ends a designation after you confirm; everything it recorded stays readable. State impact records one consequence category at a time, as Crown jewels and business impact describes.
Every one of these is a queued write: the platform records it, refreshes the indicators, and the figures follow on that refresh rather than at once. The task panel reports when it landed.
Compensating controls
A compensating control is something you state about one exposure, with the evidence for it: a web application firewall rule that blocks the request path, a segmentation rule that holds, an endpoint control verified by a test. The tab lists every control stated on an exposure on a live path, with its strength, its evidence, an optional reference to a published control identifier, and who stated it. Each row of the remediation options shows whether a control is stated on its exposure, and its State control button opens this tab on that exposure to state or restate one.
A control lowers that exposure's evidence score by at most the model's control cap, in proportion to the strength you state, from none to very strong and verified. It never erases observed evidence: a weakness someone exploited stays exploited, with a control beside it. A control above none needs evidence, and a framework saying a control should exist contributes nothing; only what you state about this exposure counts. Stating or withdrawing a control asks the platform to assess the exposure again and rebuild the paths, so the figures follow on the next build rather than at once.
Evidence and coverage
One tab says what the figures rest on and how complete the search was. It restricts the modeled union to routes whose every exposure holds a confirmed or corroborated condition and to entries whose reachability was observed rather than assumed, counts the externally reachable exposures the entry rule left out by reason, the exposures on live paths by condition basis, the paths with an unconfirmed step, the exposures gated as refuted and the paths that yield nothing; and it reports how many of the snapshot's figures were combined exactly, the assessment confidence, how many entries the search expanded, every bound it hit, the shared prerequisites across entries, the coverage reasons and the model's assumptions. A breach probability the snapshot cannot support reads as insufficient data here, never as zero, with the counts that say why.
Through the lifecycle
| Step | What you do | Where |
|---|---|---|
| Scope | Place assets in zones, mark the public boundary, model business units, designate crown jewels and state their consequences | Organizations, business units, and zones, the Crown jewels tab on this page, Crown jewels and business impact |
| Discover | Let scans, agents and integrations raise findings; the platform places them under exposures | Findings and triage, Exposures and evidence |
| Prioritize | Work the queue by SLA, severity and SSVC priority, with the modeled figures and crown-jewel reach beside them | Findings and triage, Remediation |
| Validate | Retest, run validations, declare and verify relationships; demonstrated steps replace modeled ones | Validation operations, Attack paths |
| Mobilize | Weigh remediation options by the figure that matters, propose scenarios, remediate, and let evidence verify them | Remediation |
API
The endpoints behind this page are in the API reference.
Next
- Modeled risk - what each figure means
- Crown jewels and business impact - the inputs that make the figures yours
- Remediation - the options, the scenarios and the work itself