Security Operating Surface

The Security Operating Surface is a single-screen CISO landing that combines a Posture Radar (six axes — Identity, Access, Lifecycle, Assurance, Assets, Posture) with a 4-Layer Surface Map (twenty capability tiles across Exposure, Access, Assurance, and Risk). It is the third tab on the main Dashboard. The goal is to answer three questions in under thirty seconds: how strong is our posture across the key axes, which capability layers are healthy versus at risk, and where are the blind spots.

Go to Dashboard → Security Surface to open it. The tab is visible to Owners and Managers on plans that include CISO reports (The Seed plan or higher).

What you see

Summary Bar

Five top-line KPIs across the top of the tab:

Posture Radar

Six axes drawn as a spider chart inside a regular hexagon. The dashed gray polygon at the outer edge represents the full security surface — what perfect coverage looks like. The purple fill is your current coverage. The gaps between the two polygons are the blind spots you can address.

The axes are:

• Identity — how completely identities are inventoried, scored against normalization health.
• Access — inverse of (open anomalies + stale privileges) per employee.
• Lifecycle — joiners/movers/leavers gaps; the percentage of employees with clean lifecycle status.
• Assurance — ISO 27001 readiness score from the active ISO project.
• Assets — known assets divided by total tracked (known + missing-owner) assets.
• Posture — overall maturity-program score from your latest maturity snapshot.

When a backing data source has no data, the axis collapses to the centre rather than showing a vacuous 100. An empty org sees a polygon at the centre, not a full polygon.

Surface Map

Four horizontal bands, each with five capability tiles:

• Exposure (blue) — Identities, SaaS Apps, Hardware, Cloud Resources, External Attack Surface.
• Access (violet) — Memberships Graph, Privileged Access, Access Reviews, Ghost Accounts, PAM / Vault.
• Assurance (green) — Evidence Collection, ISO 27001 SoA, Policy Docs, Control Testing, Continuous Monitoring.
• Risk (red/amber) — Access Anomalies, Lifecycle Gaps, Compliance Gaps, Vuln. Management, Incident Response.

Each tile shows a status colour (live, partial, needs-action, in-progress, or out-of-scope), a metric (e.g., “6 unresolved”, “Manual import · 23 devices”), a coverage bar, and a “data as of” footnote so a stale or failed fetch doesn’t read as “no issues found”.

Time Machine

Below the summary bar sits a horizontal chip rail: the Live chip on the right and one chip per past monthly snapshot. Clicking a past month switches the entire view — KPIs, radar polygon, and all tile metrics — to that month’s snapshot. Tile click-navigation is disabled while in historical mode; click Live to return.

If no past snapshots exist yet, the rail still renders the Live chip and a short hint explaining how history accrues — open the vCISO Monthly Summary for a past month to start building it.

Drill-Down Drawer

Clicking any active tile opens a right-side drawer showing up to eight specific entities behind the metric (e.g., the two ex-employees whose accounts are still active). Each entity row is clickable and navigates to its detail page. A View full report button at the bottom of the drawer jumps to the owning CISO or ISO report when you need more depth. Rows without a route are non-interactive — clicking them does not dismiss the drawer.

The drawer is non-modal — the surface map stays visible behind it.

Missing data, captions and the Executive tab

AutoCISO shows a value only when it has evidence for it. Unknown values appear as “—”, never as 0 or 100.

Executive tab

The Executive tab does not show an overall Security Posture score in this stage. The headline reads Overall score returns in a later release. Below it, you see {n} of {total} components have verified data.

Five components each show a value only when it is measured:

• A component without enough data shows Not enough evidence.
• The risk gauge shows Risk data unavailable when the risk data cannot be loaded.
• On the radar, axes without verified data are drawn as gaps. The legend note reads No verified data.

Asset health

An asset is Healthy only when its latest audit is complete and valid. Assets without a valid latest audit show as Not verified, the fourth slice of the doughnut. The legend note reads “Healthy counts only assets with a completed audit.”

Your Healthy count can drop after this change. The assets did not get worse. They were not verified before.

Captions and dates

Each metric section shows where its data comes from and when:

Time-machine months read Snapshot for {month}. A month without a snapshot reads No snapshot for {month} yet.

Compliance menu badge

The Compliance menu item shows a number badge. The number is the sum of four counts:

• Missing controls
• High risks
• Overdue supplier reviews
• Critical vulnerabilities

Hover over the badge to see each category. The badge is hidden when the total is 0 or when AutoCISO cannot read one of the counts.

When to use it

• Daily CISO status check in under 30 seconds — the first place you look in the morning.
• Board or executive briefings — a single screenshot replaces several CISO report pages.
• As a triage starting point before drilling into individual CISO or ISO reports.

The page is read-only. All actions live on the drill-down target pages.

Permissions and feature gating

The Security Surface tab is visible when both conditions are met:

• You hold the Owner or Manager role.
• Your plan includes CISO reports (The Seed plan or higher).

The time machine additionally requires the vCISO Workspace. Without it, the slider stays in Live-only mode and the past-month chips are hidden.

Posture history is limited to Owners and Managers: a Member cannot view past snapshots even when your plan includes the vCISO Workspace.

How snapshots are generated

Snapshots are not produced on a schedule. A month’s snapshot is created the first time someone opens the vCISO Workspace → Monthly Summary page for that month, and later visits to the same month show the saved snapshot.

Practical implication: the time-machine reflects whichever past months your team has actually opened. If you want a complete twelve-month history visible on the slider, open the Monthly Summary page once per past month you care about — they will then appear as chips on the rail the next time you visit the Security Surface tab.