Posture Score
The Posture Score is the central quantitative measure of your organization's security health in CMDash. It is expressed as both a letter grade (A–F) and a numeric score (0–100), and it recomputes whenever your connected integrations sync new data — each integration syncs on its own schedule, with a platform default of every 4 hours.
The A–F Grading System
Letter grades correspond to numeric score ranges:
| Grade | Score Range | Interpretation |
|---|---|---|
| A | 90–100 | Strong posture; all or nearly all signals are healthy |
| B | 80–89 | Good posture; minor gaps that warrant attention |
| C | 70–79 | Moderate posture; meaningful gaps requiring active management |
| D | 60–69 | Weak posture; significant exposure that should be escalated |
| F | 0–59 | Critical posture; immediate action required |
The overall grade is a weighted average of the seven signal scores. Each signal has an assigned weight that reflects its relative impact on organizational security posture. The weights are configured by default based on industry vertical (or a general baseline). A tenant-specific weight override exists as an API-level capability, but there is no in-app settings page to set one yourself today — contact support if your organization's risk profile needs a different weighting than your industry's default.
The Seven Signals
Each signal produces its own grade and numeric score (0–100). The seven signals are:
Signal 1: MTTR on Critical CVEs Mean Time to Remediate critical Common Vulnerabilities and Exposures. This measures how quickly your organization closes critical vulnerabilities from detection to remediation.
- Source data: Pulled from connected vulnerability management integrations (e.g., Tenable, CrowdStrike Falcon, Qualys).
- Calculation: Average number of days between a critical CVE being detected and marked as remediated, rolling 30-day window.
- Grade thresholds (example defaults): A = MTTR under 7 days; B = 8–14 days; C = 15–21 days; D = 22–30 days; F = over 30 days.
- How to improve: Prioritize critical CVE patching in your remediation queue. Assign owners to unpatched critical CVEs in the Remediations section and set aggressive due dates. Ensure your vulnerability scanner integration is syncing daily.
Signal 2: MFA Coverage % The percentage of user accounts across connected identity and directory systems that have multi-factor authentication enabled and enforced.
- Source data: Pulled from identity integrations (e.g., Duo, Azure AD, Okta).
- Calculation: (MFA-enabled accounts ÷ total active accounts) × 100.
- Grade thresholds (example defaults): A = 100%; B = 95–99%; C = 85–94%; D = 70–84%; F = below 70%.
- How to improve: Export the list of accounts without MFA from the signal detail panel. Work with IT to enforce MFA in your identity provider. Address service accounts and break-glass accounts separately with compensating controls, which can be documented as accepted risks in the Risk Register
[Command+].
Signal 3: Open Critical/High Vulnerabilities The total count of open (unresolved) vulnerabilities at the Critical or High severity level across your asset inventory.
- Source data: Pulled from vulnerability management integrations.
- Calculation: Raw count of open Critical + High vulnerabilities, normalized on a fixed 0–100 scale: 0 open earns full credit, falling off linearly to zero credit at 50. This is not adjusted for your asset count or organization size.
- How to improve: Work down the vulnerability backlog systematically. Use the Remediations section to assign CVE-linked tasks. Accepted risks
[Command+]can reduce the effective count when a vulnerability cannot be patched and a formal risk acceptance with rationale is documented.
Signal 4: Incident Frequency (30-Day) The number of security incidents recorded in the trailing 30 days. This signal reflects how often your environment is experiencing security events that require a response.
- Source data: Pulled from SIEM, EDR, and incident management integrations.
- Calculation: Raw incident count over the trailing 30 days, normalized on a fixed 0–100 scale: 0 incidents earns full credit, falling off linearly to zero credit at 20. This is not adjusted for organization size or industry.
- How to improve: A rising incident frequency signal should prompt review of detection and response controls. Examine trends in the Insights section to identify patterns (e.g., repeated phishing campaigns, recurring endpoint alerts). Tightening preventive controls upstream will reduce this signal over time.
Signal 5: Policy Compliance % The percentage of active policies that have been attested to by all required attestors within their required attestation period.
- Source data: Pulled from the Policy Management module within CMDash.
- Calculation: (Policies with current, completed attestations ÷ total active policies) × 100.
- Grade thresholds (example defaults): A = 100%; B = 95–99%; C = 85–94%; D = 70–84%; F = below 70%.
- How to improve: Open the Policies section and filter by "Attestation Overdue." Send reminder notifications to incomplete attestors directly from the policy record. Set shorter attestation cycles or configure automated reminders in the Notifications section.
Signal 6: SaaS Sprawl The number of discovered SaaS applications in your environment, an indicator of unmanaged shadow-IT risk.
- Source data: Pulled from your connected SaaS discovery integration.
- Calculation: Count of discovered applications, normalized on a fixed 0–100 scale: 10 or fewer apps earns full credit, falling off linearly to zero credit at 100.
- Weight: Lower-weighted than the original five signals in every industry profile.
- How to improve: Review discovered applications for ones that are unused, unsanctioned, or redundant with an existing tool, and offboard or consolidate them.
Signal 7: DLP Violations Data-loss-prevention policy violations recorded in the trailing 30 days.
- Source data: Pulled from your connected DLP integration.
- Calculation: Count of DLP events over the trailing 30 days, normalized on a fixed 0–100 scale: 0 events earns full credit, falling off linearly to zero credit at 25.
- Weight: Lower-weighted than the original five signals in every industry profile.
- How to improve: Review triggered policies for false positives versus genuine exfiltration attempts, and tighten the controls responsible for repeat violations.
Trend View
The Posture section includes a trend chart showing your overall Posture Score and individual signal scores over a selectable time window. Available windows are 30 days and 90 days.
Use the trend view to:
- Identify the cause of a score drop by comparing signal movements on a specific date
- Demonstrate improvement to leadership over a quarter
- Spot signals that trend downward gradually, indicating drift rather than a sudden event
Posture vs. Peer Benchmarking [Essentials+]
Essentials plans and above include anonymous peer comparison. CMDash aggregates anonymized posture data from organizations in the same industry vertical and revenue band. The benchmarking view shows:
- Your overall Posture Score vs. the peer median and top quartile
- Signal-by-signal comparison: where you are ahead of or behind peers
- A percentile ranking within your peer group
Benchmarking data refreshes monthly. Your organization's data contributes to the pool anonymously; no identifying information is shared. Use this view to contextualize your posture for board and executive audiences and to prioritize investments in signals where you significantly lag peers.