Understanding Your Posture Score

The Posture Score is the top-level security health indicator in CMDash. It gives you a single, defensible letter grade — A through F — that summarizes your organization's cybersecurity posture at a glance. The score is live: it recalculates whenever your connected integrations sync new data.

Why the Posture Score Matters

Security programs generate enormous volumes of data — vulnerability counts, MFA enrollment rates, incident logs, compliance attestations. Translating that data into a conversation your board can understand is one of the hardest parts of a CISO's job.

The Posture Score solves that problem. Instead of presenting raw numbers, you present a grade. Instead of explaining what a CVE is, you explain why your grade moved from a B to a B+. The score becomes a shared language between your security team, your executive leadership, and your board.

The score also creates accountability over time. Because it recalculates continuously, it captures improvement (and regression) in a way that static point-in-time assessments cannot.

The 7 Signals

The Posture Score is computed from seven signals, each reflecting a distinct dimension of operational security health and populated automatically from your connected integrations. The signals are not equally weighted — the default weighting favors Mean Time to Patch and Open Critical Vulnerabilities, and CMDash also applies a different default weighting profile per industry vertical (healthcare, fintech, SaaS, biotech, manufacturing, and a general baseline).

1. MTTR on Critical CVEs

Mean Time to Remediate measures how quickly your team closes critical vulnerabilities after they are identified. Faster remediation translates directly to reduced exposure window.

• How it is calculated: The average number of days between first detection and confirmed remediation across all critical-severity CVEs opened in the trailing 90 days.
• Integrations that populate this signal: Tenable, CrowdStrike Falcon, SentinelOne.
• What a good score looks like: MTTR under 15 days for critical CVEs earns full credit for this signal. MTTR over 60 days significantly depresses your grade.
• Example: If Tenable detects a critical CVE on June 1 and your team patches it on June 12, that finding contributes 11 days to your MTTR.

2. MFA Coverage

MFA Coverage measures the percentage of active user accounts in your identity systems that have multi-factor authentication enabled. MFA is one of the most effective single controls against account compromise.

• How it is calculated: (accounts with MFA enabled) ÷ (total active accounts) × 100.
• Integrations that populate this signal: Okta, Duo, Azure Active Directory, Microsoft Defender for Identity.
• What a good score looks like: 95% or higher earns full credit. Scores below 80% have a material negative impact on your grade.
• Common gap: Service accounts, shared accounts, and recently onboarded users are frequent sources of MFA gaps. The Identity Coverage page (Command tier and above) tracks "MFA enrolled" as one of its coverage stages across every connected identity source.

3. Open Critical and High Vulnerabilities

Open Vulnerability Count measures the current backlog of unpatched critical and high-severity CVEs across your environment. Unlike MTTR (which measures speed), this signal measures the size of your current exposure.

• How it is calculated: Total count of open critical and high CVEs at the time of the most recent integration sync.
• Integrations that populate this signal: Tenable, CrowdStrike Falcon, SentinelOne, Qualys (where connected).
• What a good score looks like: The signal uses a fixed scale, not one normalized to your organization's size: 0 open critical/high vulnerabilities earns full credit, and the score falls off linearly to zero credit at 50. It is not adjusted for the number of managed assets your scanner reports.
• Example: An organization with 8 open critical/high CVEs scores the same on this signal whether it has 200 assets or 2,000 — 8 ÷ 50 puts it at 84/100 either way, since the count is not weighed against asset totals.

4. Incident Frequency (30-Day)

Incident Frequency measures the number of confirmed security incidents in the trailing 30 days. Higher incident rates indicate either a more hostile threat environment, detection gaps that are generating noise, or both.

• How it is calculated: Count of incidents with severity Medium or higher created or escalated in the past 30 days.
• Integrations that populate this signal: Splunk, Microsoft Sentinel, CrowdStrike Falcon (incident feed), SentinelOne.
• Important nuance: If you have no SIEM or EDR integration connected, this signal scores at 0 (worst), because CMDash cannot confirm that incidents are being tracked. Connecting even one integration unlocks scoring.

5. Policy Compliance Percentage

Policy Compliance measures what fraction of your active policies have current, valid attestations from their assigned owners. Policies without up-to-date sign-off represent gaps in your governance program.

• How it is calculated: (policies with valid attestation within their review cycle) ÷ (total active policies) × 100.
• Driven by: CMDash's Policy module. Each policy has a configured review interval (e.g., annual, semi-annual). A policy is considered compliant when its attestation date is within that interval.
• What a good score looks like: 90% or higher earns full credit. Any policy past its attestation date counts as non-compliant.

6. SaaS Sprawl

SaaS Sprawl measures the number of discovered SaaS applications in your environment. Excessive sprawl is a leading indicator of unmanaged shadow-IT risk.

• How it is calculated: Count of applications from your SaaS discovery integration. 10 or fewer apps earns full credit; 100 or more scores 0, linear in between.
• Integrations that populate this signal: Your connected SaaS discovery integration.
• Weight: Lower-weighted than the original five signals in every industry profile.

7. DLP Violations

DLP Violations measures data-loss-prevention policy violations in the trailing 30 days. Lower is better.

• How it is calculated: Count of DLP events in the trailing 30 days. 0 events earns full credit; 25 or more scores 0, linear in between.
• Integrations that populate this signal: Your connected DLP integration.
• Weight: Lower-weighted than the original five signals in every industry profile.

Grade Thresholds

How the Overall Grade Is Computed

The seven signals do not contribute equally. For each signal, CMDash calculates a 0–100 sub-score based on the signal's measured value relative to its scoring curve, then combines the sub-scores using the signal weights for your organization's industry (or a general baseline if your industry has no dedicated profile) to produce the overall 0–100 numeric score, which then maps to a letter grade. A signal with no connected integration is excluded from the calculation entirely rather than penalized or given free credit, and the remaining signals' weights are rescaled to still sum to 100%.

Example calculation (general baseline weighting):

The numeric score is always shown alongside the letter grade on your Dashboard.

How to Improve Your Grade

Improving MTTR on Critical CVEs

• Define and document a patching SLA (e.g., critical CVEs patched within 14 days of detection). Use CMDash's Policy module to formalize the SLA.
• Create remediation tasks in CMDash directly from vulnerability findings using the Remediations page ("New Remediation Task").
• Ensure your vulnerability scanner syncs daily so detections surface in CMDash promptly.
• Focus first on production and internet-facing assets — those carry the highest impact if exploited.

Improving MFA Coverage

• Enable an MFA enforcement policy in your identity provider (Okta, Azure AD, or Duo). Enforcement is more reliable than opt-in adoption.
• After enforcing MFA at the IdP level, trigger a manual sync in CMDash (Integrations → [your IdP] → Sync Now) to see the updated coverage immediately.
• Use the Identity Coverage page (Command tier and above) to see MFA enrollment across every connected identity source and identify specific accounts for follow-up.
• CMDash does not currently offer a self-service way to exclude specific break-glass or service accounts from the MFA coverage signal; contact support if these accounts are materially distorting your score.

Reducing Open Critical and High Vulnerabilities

• Use asset tagging in your scanner to prioritize production, customer-facing, and privileged-access systems.
• Set up automated ticket creation from CMDash to your ticketing system (Jira, ServiceNow) for each new critical CVE — this reduces time-to-assignment.
• Close false positives in your scanner and re-sync; CMDash will reflect the updated count.

Reducing Incident Frequency

• Review your SIEM alert tuning. High incident frequency can reflect genuine threats or noisy detections — both need attention.
• Close or merge duplicate incidents in your SIEM or EDR; CMDash counts distinct incidents, not alerts.
• Investigate whether a spike is driven by a single campaign (e.g., a phishing wave) versus a systemic issue.

Improving Policy Compliance Percentage

• Start an attestation campaign from the policy's detail page and use its Remind now action to notify pending assignees.
• Review a policy's attestation roster (on its detail page) to see who has and hasn't attested.
• If a policy is no longer relevant, set its status to Retired rather than leaving it overdue (policy statuses are Draft, Active, In Review, and Retired). Retired policies do not count against your compliance percentage.

Posture Trends

CMDash displays 30-day and 90-day trend charts on your Dashboard below the Posture Score card. Each chart shows daily score history as a line graph, with signal-level breakdown available by hovering over any data point.

What to look for in your trend charts:

• Sudden drops: A score that falls 5+ points overnight usually points to a new batch of vulnerabilities detected by a scanner sync, a spike in incidents, or one or more policies crossing into overdue status. Check the signal breakdown for the specific date.
• Gradual decline: Slow, sustained decline usually means your remediation velocity is not keeping pace with new vulnerability discovery, or your policy attestations are aging out faster than owners are reviewing them.
• Plateau: A flat line near your target grade indicates a steady state. Review whether you are maintaining the grade or simply not receiving new data (check integration sync status).
• Improvement trajectory: Use the 90-day chart when presenting to your board to show directional progress over a meaningful period.

Peer Benchmarking [Command+]

The actual requirement is Essentials or above, not Command+.

With an Essentials subscription or above, CMDash includes an anonymous peer benchmark comparison on its own Peer Benchmarking page (in the main nav). CMDash groups your organization with peers in the same industry vertical and shows:

• Your score vs. the peer group median
• Your approximate percentile within the peer group
• A per-signal comparison against peer benchmarks
• An opt-in prompt if your organization isn't yet contributing its own (anonymized) data to the benchmark pool

All benchmark data is aggregated and anonymized. No individual organization's data is ever identifiable in benchmark results.

To view peer benchmarking: open Peer Benchmarking from the main navigation (not a tab on the Dashboard's Posture Score card).

Common Questions

Why did my score drop overnight?

The most common causes are: (1) a vulnerability scanner sync that detected new critical CVEs, increasing your open vulnerability count; (2) one or more policies crossing their attestation deadline and becoming overdue; or (3) a spike in incidents logged to your SIEM in the past 24 hours. Click through the Posture Score card on your Dashboard to the Posture page to see which of the seven signals changed and by how much.

Why is MFA coverage below 100% even though I enforce MFA?

IdP enforcement policies sometimes have exceptions — service accounts, API accounts, legacy application accounts, or recently created accounts in a grace period. CMDash counts all active accounts in the directory, including those that may be excluded from your enforcement policy. Review the Identity Coverage page (Command tier and above) to see which accounts lack MFA. CMDash does not currently offer a self-service way to mark specific accounts as excluded from the MFA coverage denominator; contact support if non-human service accounts are materially distorting your score.

Can I customize signal weights?

Not from the dashboard UI. CMDash already applies non-equal, industry-specific default weights (see "How the Overall Grade Is Computed" above) rather than splitting the score evenly across signals, and a tenant-specific weight override exists as an API-level capability — but there is no in-app settings page to set one yourself today. If your organization's risk profile needs a different weighting than your industry's default, contact support.