Security Posture

The Security Posture tab provides a comprehensive view of your project's overall security health, combining vulnerability data, attestation scores, and risk metrics into actionable insights.

Overview

Security posture assessment helps you:

• Understand overall project security health
• Track security improvements over time
• Identify areas requiring attention
• Compare security across projects
• Report security metrics to stakeholders

Security Posture Score

Each project receives a Security Posture Score (0-100):

Score Components

Vulnerability Score (40%)

Based on:

• Number of vulnerabilities by severity
• EPSS exploitation probability
• KEV (Known Exploited Vulnerabilities) presence
• Vulnerability age

Attestation Score (25%)

Based on:

• Component integrity verification
• Supply chain attestation (SLSA)
• Signature verification status
• Malicious package detection

Dependency Health (20%)

Based on:

• Dependency freshness
• Maintenance status
• Community activity
• Security advisory response time

Compliance Score (15%)

Based on:

• EO 14028 compliance
• License compliance
• SBOM completeness
• Policy adherence

Viewing Security Posture

1. Open a project from the Projects page
2. Navigate to the Security Posture tab
3. View the comprehensive security assessment

Dashboard Elements

Score Details

Vulnerability Breakdown

Attestation Breakdown

Improving Your Score

Quick Wins

1. Update critical dependencies - Fix critical CVEs first
2. Enable AI Remediate - Auto-generate fix PRs
3. Remove unused dependencies - Reduce attack surface
4. Update base images - Fresh container bases

Long-term Improvements

1. Establish patching cadence - Regular update schedule
2. Implement security gates - Block vulnerable deployments
3. Improve SBOM completeness - Better component data
4. Adopt attested packages - Use verified components

Trend Analysis

Score History

View how your score changes over time:

• Daily score snapshots
• Weekly trends
• Monthly comparisons
• Year-over-year analysis

Score Events

Track what caused score changes:

Organization Dashboard

View aggregate security posture across all projects:

1. Go to Dashboard
2. View Security Posture Overview
3. See organization-wide metrics

Organization Metrics

Reporting

Generate Security Report

1. Click Export → Security Posture Report
2. Select time range
3. Choose format (PDF, HTML)
4. Download report

Report Contents

• Executive summary
• Score breakdown
• Trend analysis
• Risk inventory
• Remediation recommendations
• Comparison to previous period

API Access

Access security posture data via API:

# Get security posture for a project
curl -X GET https://api.safeguard.sh/v1/projects/{id}/security-posture \
  -H "Authorization: Bearer $API_KEY"

# Get score history
curl -X GET https://api.safeguard.sh/v1/projects/{id}/security-posture/history \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"start_date": "2025-01-01", "end_date": "2025-01-31"}'

Benchmarking

Compare your security posture:

Industry Benchmarks

See how you compare to:

• Industry average
• Top performers
• Similar project sizes
• Same technology stack

Internal Benchmarks

Compare across your organization:

• Team comparisons
• Project type comparisons
• Business unit comparisons

Alerts and Notifications

Configure alerts for security posture changes:

Best Practices

Monitoring

• Review security posture weekly
• Set up alerts for score drops
• Track trends over time
• Celebrate improvements

Improvement

• Prioritize based on score impact
• Address critical issues first
• Set score targets for projects
• Include security in sprint planning

Reporting

• Share reports with stakeholders
• Include in release documentation
• Track against organizational goals
• Use for compliance evidence

Next Steps

• Vulnerabilities
• AI Remediate
• Policies & Gates