Skip to content

CISO

Know where you stand, without asking four teams.

You need a defensible answer to where the risk sits, what is being done about it, and what is waiting on you. Not a dashboard tour.

Click through NIST CSF 2.0 in the Demo Center →

What changes

What your week looks like

Left is the week you have. Right is the same week on the platform. Nothing else on this page matters more than whether the left column is recognisable.

  1. Board reporting is assembled by hand from four tools and three spreadsheets.

    Scheduled deliverables generate on cadence, wait for an analyst to review them, and log where each one was sent.

  2. You are asked for a risk position and you can give a narrative, not a number.

    A Risk Posture Score from 0 to 100, with the drivers behind it and the delta against the prior period.

  3. Decisions sit waiting because nobody surfaced them to you.

    Decision items carry their urgency, their source and their owner. A queue, rather than an inbox.

  4. You find out an incident mattered when it's already escalated.

    Shift handover compiles itself at the boundary, so the escalation and the context behind it arrive together.

Access

What you own, and what you can reach.

The platform has three roles, not six. This is the one you would hold, enforced at the route on the client and again on the server rather than hidden in the interface.

Platform role

Admin

What it opens
The CISO Cockpit and the Management Portal, both admin-only and enforced at the route on the client and again on the server, plus every subscribed agent.
What it does not
Nothing above it. Admin is the widest role: user and invitation management and organisation settings sit inside it too.

The measure

The numbers you would be judged on.

Published targets and platform behaviour, not projections. Where one of these is a target rather than an achievement, it says so.

  • < 4 hrs

    MTTD target

    Mean time to detect, against the hub's own published target.

  • < 24 hrs

    MTTR target

    Mean time to respond, on the same board.

  • < 30:1

    Alert-to-incident

    The ratio the hub holds the programme to.

  • D1-D20

    SOC deliverables

    Tracked in the Compliance Vault as documented or awaiting.

Your workspaces

What you would actually open.

You can turn one on and add the others later. A connector configured for one is available to the rest.

Questions

The things people ask first.

  • Is the posture score a real number or a marketing one?

    It is computed from the agents and connected tools underneath it, and it opens to show its drivers and the delta on the prior period. Where a source is offline the panel says so and timestamps the cached value instead of quietly serving a stale figure.

  • What actually reaches me, versus my team?

    Decision items are the actions that need a leadership call, policy exceptions and major escalations, each with an urgency, a source and an owner. Everything else resolves in the agents' own queues and shows up in the reporting, not on your desk.

  • Can I take the reporting to a board without reformatting it?

    The Report Center produces the deliverables on cadence as PDF or Excel, holds them for analyst review before they publish, and logs which channel each one went to. Root-cause write-ups come from the Incident Center, structured as root cause, containment actions, and lessons learned.

  • Does this need my team using every agent?

    No. The cockpit aggregates whatever is connected, and an agent you haven't turned on simply doesn't contribute a panel. Turning one on later adds its numbers without reconfiguring what is already there.

The rest of the team

You are almost certainly not the only person who has to agree to this.