Security Posture Overview
COMPILED · APR 2026 · FOR: BOARD / EXECUTIVE LEADERSHIP
Overall Score
MODERATE
▲ +4 pts from last month
Open Findings
ACTION
23
Across all domains
■ 4 Critical ■ 11 High ■ 8 Med
SaaS Apps
MONITORED
128
Active applications
12 unlicensed · 7 orphaned
Compliance
IN PROGRESS
68%
NIST CSF coverage
SOC 2: 54% · ISO: 41%
Risk by Domain
Recent Activity
7 DAYS
Critical: 4 admin accounts without MFA in Workspace
Vendor: CoreSync DPA renewal due in 18 days
Resolved: Phishing IR closed via Shield IR
SaaS: 12 apps without SSO flagged
Compliance: NIST CSF updated — 68% coverage
Endpoint Coverage
Protected
847
Unmanaged
53
MFA Adoption
MFA Active
638
No MFA
262
Vendor DPAs
Executed
18
Missing
12
SaaS Governance
LICENSE OPTIMIZATION · ACCESS CONTROL · CONTRACT RENEWALS · 128 APPS
Total Apps
TRACKED
128
Active applications
▲ +7 from last quarter
Annual Spend
REVIEW
$284K
Annualized license cost
▼ $32K savings identified
SSO Coverage
PARTIAL
74%
Apps with SSO enabled
12 apps without SSO
Renewals Due
90 DAYS
8
Contracts expiring
3 this month · 5 next
Spend by Category
Upcoming Renewals
| App | Date | Cost | Status |
|---|---|---|---|
| CoreSync | May 12 | $14K | DPA Due |
| Klaviyo | May 18 | $8.4K | Review |
| Okta | Jun 1 | $31K | Ready |
| CrowdStrike | Jun 8 | $47K | Gap Open |
| Clearwatch MDR | Jun 15 | $28K | Ready |
| Jamf Pro | Jun 22 | $12K | Ready |
Apps Without SSO
12 FLAGGED
| App | Category | Users | Risk |
|---|---|---|---|
| Canva | Design | 42 | High |
| Trello | PM | 28 | High |
| Loom | Video | 19 | Med |
| Figma | Design | 15 | Med |
| Calendly | Scheduling | 12 | Med |
| Typeform | Forms | 8 | Low |
License Waste
$32K
Compliance Posture
NIST CSF · SOC 2 TYPE II · ISO 27001
NIST CSF
IN PROGRESS
Identify82%
Protect71%
Detect65%
Respond60%
Recover48%
SOC 2 Type II
GAP PHASE
Security (CC)63%
Availability (A)70%
Confidentiality (C)44%
Processing Int.39%
Privacy (P)48%
ISO 27001
EARLY STAGE
A.5 Policies60%
A.6 Org Controls45%
A.8 Asset Mgmt55%
A.9 Access Control62%
A.12 Operations28%
Open Compliance Gaps
18 ITEMS
| Control | Framework | Description | Owner | Priority |
|---|---|---|---|---|
| CC6.1 | SOC 2 | Logical access provisioning not documented | IT Security | Critical |
| ID.AM-2 | NIST CSF | Software asset inventory incomplete | IT Ops | Critical |
| A.12.4 | ISO 27001 | Event logging not centralized | IT Security | High |
| RS.CO-2 | NIST CSF | Incident reporting criteria not defined | Legal | High |
| CC9.2 | SOC 2 | Vendor risk assessment undocumented | Procurement | Medium |
| RC.RP-1 | NIST CSF | Recovery plan not tested in 12 months | IT Ops | Medium |
Vendor Risk Management
DPA STATUS · SECURITY POSTURE · CONTRACT REVIEW · 30 VENDORS
Vendors Tracked
30
Active relationships
DPA Coverage
PARTIAL
60%
18 executed · 12 missing
High Risk
REVIEW
4
Vendors requiring action
Assessments Due
7
Annual reviews overdue
Vendor Risk Register
| Vendor | Category | Risk | DPA | Last Review | Finding |
|---|---|---|---|---|---|
| CoreSync | Platform/API | High · 68 | Renew | Mar 2026 | API platform migration; EDR coverage gap |
| Klaviyo | Email/Marketing | Med · 54 | Review | Feb 2026 | MSA clause 7.3 under legal review |
| CrowdStrike | EDR/Security | Low · 22 | Done | Jan 2026 | Coverage gap on contractor fleet (53 devices) |
| Clearwatch MDR | MDR/SIEM | Low · 18 | Done | Jan 2026 | Clean assessment |
| Okta | IAM/SSO | Low · 20 | Done | Dec 2025 | Clean assessment |
| AWS | Cloud Infra | Med · 41 | Done | Nov 2025 | IAM least-privilege gaps in 3 accounts |
| Shield IR | Phishing IR | Low · 24 | Draft | Apr 2026 | DPA in draft; IR contract active |
Risk Distribution
DPA Status
18 vendors — DPAs signed and on file
5 vendors — Legal review in progress
7 vendors — No DPA on file; outreach required
Identity & Access Management
MFA COVERAGE · PRIVILEGED ACCESS · ORPHANED ACCOUNTS · SSO HEALTH
Total Identities
900
Users + contractors
638 employees · 262 contractors
MFA Coverage
RISK
71%
639 enrolled / 261 without
▼ 4 admins without MFA
Orphaned Accounts
ACTION
34
Inactive >90 days
12 with active app access
Privileged Accounts
28
Admin / elevated roles
6 without PAM controls
MFA by Department
Critical Findings
5 OPEN
4 admin accounts in Workspace without MFA — immediate remediation required
12 former contractor accounts retain active SaaS access post-offboarding
6 privileged accounts without PAM logging — admin actions unaudited
Quarterly access review overdue — 34 accounts flagged
SSO by App Category
Privileged Access
| Role | Count | MFA | PAM |
|---|---|---|---|
| Global Admin | 6 | 4/6 | 2/6 |
| Cloud Root | 4 | 4/4 | 3/4 |
| Domain Admin | 3 | 3/3 | 3/3 |
| Security Admin | 5 | 5/5 | 5/5 |
| Finance Admin | 4 | 3/4 | 1/4 |
| App Admins | 6 | 3/6 | 0/6 |
Incident & Alert Posture
EDR · SIEM · PHISHING · OPEN INCIDENTS · 30-DAY WINDOW
Open Incidents
ACTIVE
2
In active investigation
0 critical · 2 medium
Alerts (30d)
847
Total alerts generated
94% auto-closed · 6% reviewed
Phishing (30d)
24
Attempts detected
1 escalated · all contained
MTTD / MTTR
HEALTHY
4.2h
MTTD
18h
MTTR
Alert Volume by Source
Alert Triage
Auto-closed
796
Reviewed
36
Escalated
15
Incident Log — Last 30 Days
| ID | Date | Type | Severity | Status | Summary |
|---|---|---|---|---|---|
| INC-041 | Apr 28 | IAM | Medium | Open | Admin login from unrecognized IP |
| INC-040 | Apr 26 | Phishing | Medium | Closed | Credential harvest attempt — contained by Shield IR |
| INC-039 | Apr 22 | Endpoint | High | Closed | Suspicious process on contractor device — quarantined |
| INC-038 | Apr 19 | SaaS | Medium | Closed | Unauthorized OAuth app — Workspace access revoked |
| INC-037 | Apr 14 | Network | Medium | Open | Anomalous outbound traffic — investigation ongoing |
| INC-036 | Apr 9 | Phishing | Low | Closed | BEC simulation — user reported correctly |