# Security Operating Surface URL: https://docs.autociso.io/product/posture/security-surface/ Description: Helicopter-view CISO landing on the Dashboard — a 6-axis posture radar and a 20-tile surface map, with a time-machine slider for replaying past monthly snapshots. The Security Operating Surface is a single-screen CISO landing that combines a **Posture Radar** (six axes — Identity, Access, Lifecycle, Assurance, Assets, Posture) with a **4-Layer Surface Map** (twenty capability tiles across Exposure, Access, Assurance, and Risk). It is the third tab on the main [Dashboard](https://docs.autociso.io/console/overview/dashboard/). The goal is to answer three questions in under thirty seconds: how strong is our posture across the key axes, which capability layers are healthy versus at risk, and where are the blind spots. Go to **Dashboard → Security Surface** to open it. The tab is visible to [Owners and Managers](https://docs.autociso.io/getting-started/roles-and-permissions/) on plans that include CISO reports ([The Seed plan or higher](https://docs.autociso.io/getting-started/plans-and-features/)). ## What you see ### Summary Bar Five top-line KPIs across the top of the tab: | KPI | Source | |-----|--------| | Surface covered % | Average of the six radar axes | | Active risk findings | Open access anomalies + stale-privilege count | | ISO 27001 readiness % | Current ISO project [readiness score](https://docs.autociso.io/console/iso/readiness/) | | Identities monitored | Employee count | | Open decisions | vCISO [open decisions](https://docs.autociso.io/console/vciso/decisions/) count | ### Posture Radar Six axes drawn as a spider chart inside a regular hexagon. The dashed gray polygon at the outer edge represents the **full security surface** — what perfect coverage looks like. The purple fill is **your current coverage**. The gaps between the two polygons are the blind spots you can address. The axes are: - **Identity** — how completely identities are inventoried, scored against [normalization health](https://docs.autociso.io/console/ciso-reports/normalization-health/). - **Access** — inverse of (open anomalies + stale privileges) per employee. - **Lifecycle** — joiners/movers/leavers gaps; the percentage of employees with clean lifecycle status. - **Assurance** — ISO 27001 readiness score from the active ISO project. - **Assets** — known assets divided by total tracked (known + missing-owner) assets. - **Posture** — overall maturity-program score from your latest maturity snapshot. When a backing data source has no data, the axis collapses to the centre rather than showing a vacuous 100. An empty org sees a polygon at the centre, not a full polygon. ### Surface Map Four horizontal bands, each with five capability tiles: - **Exposure** (blue) — Identities, SaaS Apps, Hardware, Cloud Resources, External Attack Surface. - **Access** (violet) — Memberships Graph, Privileged Access, Access Reviews, Ghost Accounts, PAM / Vault. - **Assurance** (green) — Evidence Collection, ISO 27001 SoA, Policy Docs, Control Testing, Continuous Monitoring. - **Risk** (red/amber) — Access Anomalies, Lifecycle Gaps, Compliance Gaps, Vuln. Management, Incident Response. Each tile shows a status colour (live, partial, needs-action, in-progress, or out-of-scope), a metric (e.g., "6 unresolved", "Manual import · 23 devices"), a coverage bar, and a "data as of" footnote so a stale or failed fetch doesn't read as "no issues found". ### Time Machine Below the summary bar sits a horizontal chip rail: the **Live** chip on the right and one chip per past monthly snapshot. Clicking a past month switches the entire view — KPIs, radar polygon, and all tile metrics — to that month's snapshot. Tile click-navigation is disabled while in historical mode; click **Live** to return. If no past snapshots exist yet, the rail still renders the Live chip and a short hint explaining how history accrues — open the vCISO [Monthly Summary](https://docs.autociso.io/console/vciso/monthly-summary/) for a past month to start building it. ### Drill-Down Drawer Clicking any active tile opens a right-side drawer showing up to eight specific entities behind the metric (e.g., the two ex-employees whose accounts are still active). Each entity row is clickable and navigates to its detail page. A **View full report** button at the bottom of the drawer jumps to the owning CISO or ISO report when you need more depth. Rows without a route are non-interactive — clicking them does not dismiss the drawer. The drawer is non-modal — the surface map stays visible behind it. ## Missing data, captions and the Executive tab AutoCISO shows a value only when it has evidence for it. Unknown values appear as "—", never as 0 or 100. ### Executive tab The **Executive** tab does not show an overall Security Posture score in this stage. The headline reads **Overall score returns in a later release**. Below it, you see `{n} of {total} components have verified data`. Five components each show a value only when it is measured: - A component without enough data shows **Not enough evidence**. - The risk gauge shows **Risk data unavailable** when the risk data cannot be loaded. - On the radar, axes without verified data are drawn as gaps. The legend note reads **No verified data**. ### Asset health An asset is **Healthy** only when its latest audit is complete and valid. Assets without a valid latest audit show as **Not verified**, the fourth slice of the doughnut. The legend note reads "Healthy counts only assets with a completed audit." Your **Healthy** count can drop after this change. The assets did not get worse. They were not verified before. ### Captions and dates Each metric section shows where its data comes from and when: | Caption | Meaning | |---------|---------| | `{scope} · Observed {date}` | The date the source system reported the data | | Source date unavailable | The source gave no date | | `Calculated {date}` | AutoCISO calculated the value on this date | | `Loaded {time}` | The page loaded the data at this time | | The last refresh failed. Showing data loaded earlier. | The refresh failed. You see older data | Time-machine months read `Snapshot for {month}`. A month without a snapshot reads `No snapshot for {month} yet`. ## Compliance menu badge The **Compliance** menu item shows a number badge. The number is the sum of four counts: - Missing controls - High risks - Overdue supplier reviews - Critical vulnerabilities Hover over the badge to see each category. The badge is hidden when the total is 0 or when AutoCISO cannot read one of the counts. ## When to use it - Daily CISO status check in under 30 seconds — the first place you look in the morning. - Board or executive briefings — a single screenshot replaces several CISO report pages. - As a triage starting point before drilling into individual CISO or ISO reports. The page is **read-only**. All actions live on the drill-down target pages. ## Permissions and feature gating The Security Surface tab is visible when **both** conditions are met: - You hold the **Owner** or **Manager** role. - Your plan includes CISO reports (The Seed plan or higher). The time machine additionally requires the [vCISO Workspace](https://docs.autociso.io/product/posture/vciso-workspace/). Without it, the slider stays in Live-only mode and the past-month chips are hidden. Posture history is limited to Owners and Managers: a Member cannot view past snapshots even when your plan includes the vCISO Workspace. ## How snapshots are generated Snapshots are not produced on a schedule. A month's snapshot is created the first time someone opens the **vCISO Workspace → Monthly Summary** page for that month, and later visits to the same month show the saved snapshot. Practical implication: the time-machine reflects whichever past months your team has actually opened. If you want a complete twelve-month history visible on the slider, open the Monthly Summary page once per past month you care about — they will then appear as chips on the rail the next time you visit the Security Surface tab.