Security Operating Surface

The Security Operating Surface is a single-screen CISO landing that combines a Posture Radar (six axes — Identity, Access, Lifecycle, Assurance, Assets, Posture) with a 4-Layer Surface Map (twenty capability tiles across Exposure, Access, Assurance, and Risk). It is the third tab on the main Dashboard. The goal is to answer three questions in under thirty seconds: how strong is our posture across the key axes, which capability layers are healthy versus at risk, and where are the blind spots.

Go to Dashboard > Security Surface to open it. The tab is visible to tenant managers and owners on plans that include the ciso_reports feature.

What you see

Summary Bar

Five top-line KPIs across the top of the tab:

Posture Radar

Six axes drawn as a spider chart inside a regular hexagon. The dashed gray polygon at the outer edge represents the full security surface — what perfect coverage looks like. The purple fill is your current coverage. The gaps between the two polygons are the blind spots you can address.

The axes are:

• Identity — how completely identities are inventoried, scored against normalization health.
• Access — inverse of (open anomalies + stale privileges) per employee.
• Lifecycle — joiners/movers/leavers gaps; the percentage of employees with clean lifecycle status.
• Assurance — ISO 27001 readiness score from the active ISO project.
• Assets — known assets divided by total tracked (known + missing-owner) assets.
• Posture — overall maturity-program score from your latest maturity snapshot.

When a backing data source has no data, the axis collapses to the centre rather than showing a vacuous 100. An empty org sees a polygon at the centre, not a full polygon.

Surface Map

Four horizontal bands, each with five capability tiles:

• Exposure (blue) — Identities, SaaS Apps, Hardware, Cloud Resources, External Attack Surface.
• Access (violet) — Memberships Graph, Privileged Access, Access Reviews, Ghost Accounts, PAM / Vault.
• Assurance (green) — Evidence Collection, ISO 27001 SoA, Policy Docs, Control Testing, Continuous Monitoring.
• Risk (red/amber) — Access Anomalies, Lifecycle Gaps, Compliance Gaps, Vuln. Management, Incident Response.

Each tile shows a status colour (live, partial, needs-action, in-progress, or out-of-scope), a metric (e.g., “6 unresolved”, “Manual import · 23 devices”), a coverage bar, and a “data as of” footnote so a stale or failed fetch doesn’t read as “no issues found”.

Time Machine

Below the summary bar sits a horizontal chip rail: the Live chip on the right and one chip per past monthly snapshot. Clicking a past month switches the entire view — KPIs, radar polygon, and all tile metrics — to that month’s snapshot. Tile click-navigation is disabled while in historical mode; click Live to return.

If no past snapshots exist yet, the rail still renders the Live chip and a short hint explaining how history accrues — open the vCISO Monthly Summary for a past month to start building it.

Drill-Down Drawer

Clicking any active tile opens a right-side drawer showing up to eight specific entities behind the metric (e.g., the two ex-employees whose accounts are still active). Each entity row is clickable and navigates to its detail page. A View full report button at the bottom of the drawer jumps to the owning CISO or ISO report when you need more depth. Rows without a route are non-interactive — clicking them does not dismiss the drawer.

The drawer is non-modal — the surface map stays visible behind it.

When to use it

• Daily CISO status check in under 30 seconds — the first place you look in the morning.
• Board or executive briefings — a single screenshot replaces several CISO report pages.
• As a triage starting point before drilling into individual CISO or ISO reports.

The page is read-only. All actions live on the drill-down target pages.

Permissions and feature gating

The Security Surface tab is visible when both conditions are met:

• The user holds the tenant:manager or tenant:owner role (system owners and system managers also see it).
• The org’s plan includes the ciso_reports feature (Seed plan and above).

Time-machine snapshot data additionally requires the vciso_workspace feature. On plans with ciso_reports but without vciso_workspace, the time-machine slider stays in Live-only mode — the snapshot list endpoint returns 403 and the slider hides the past-month chips gracefully.

Backend snapshot endpoints (GET /api/v1/vciso/snapshot and GET /api/v1/vciso/monthly-snapshots) are role-gated to manager and owner; a tenant:member role cannot fetch posture history even when the org has the vciso_workspace feature.

How snapshots are generated

There is no scheduled monthly job. Snapshots are computed on demand when someone opens the vCISO > Monthly Summary page for a given month — that page’s request triggers ComputeMonthlySnapshot, which aggregates the KPIs and upserts a row keyed by (orgId, year, month). Subsequent requests for the same month return the cached row.

Practical implication: the time-machine reflects whichever past months your team has actually opened. If you want a complete twelve-month history visible on the slider, open the Monthly Summary page once per past month you care about — they will then appear as chips on the rail the next time you visit the Security Surface tab.