Security Posture
Component and security-posture-check distribution breakdowns for your projects, products, and components
Security Posture
The Security Posture tab shows how your project's components and security-posture checks break down — by classification and by severity — so you can spot where risk is concentrated and jump straight into the underlying data.
Overview
The Security Posture tab helps you:
- See your component mix at a glance (Open Source, Third Party, Private, Unknown)
- See your security-posture checks broken down by severity
- Drill into any group's underlying components or checks via Griffin AI Search
- Scope the same view to a project, a product, or a single component's dependency subtree
Viewing Security Posture
- Open a project from the Projects page
- Navigate to the Security Posture tab
- View the component and security-posture-check distribution breakdowns
The Security Posture view is available at three levels — project, product, and component — from the corresponding tab on each entity's detail page. At the component level, the view includes the selected component's full subtree of child components.
Dashboard Elements
| Element | Description |
|---|---|
| Component Distribution | Stat cards showing your total component count, broken down by classification: Open Source, Third Party, Private, and Unknown (anything that doesn't resolve to a known classification) |
| Security Posture Distribution | Stat cards showing your total security posture check count, broken down by severity: Critical, High, Medium, Low, and Unknown |
| Chart button | On the Security Posture Distribution panel — opens a donut chart ("Security Posture Severity Breakdown") plotting checks by severity |
| Security Postures table | A sortable, filterable, paginated table of the underlying security posture checks, below the two panels, with export and refresh controls |
Each stat card shows a raw count for its group along with that group's percentage of the panel's total.
Example. Say a project's Component Distribution panel shows a total of 640 components, split 410 Open Source / 150 Third Party / 60 Private / 20 Unknown (roughly 64% / 23% / 9% / 3% of the total). If you instead open the Security Posture tab on one component within that project, the panel re-scopes to that component's full subtree — the component itself plus every descendant component in its dependency tree — so the counts reflect just that branch, not the whole project.
Drilling in with Griffin AI Search
Every group card in the Component Distribution and Security Posture Distribution panels — and each panel's total — is clickable. Clicking one doesn't just highlight a number; it sends a natural-language prompt into Griffin AI Search and takes you straight to the matching results, so you don't have to construct the equivalent search yourself.
| Click target | Prompt sent to Griffin |
|---|---|
| Component Distribution total | "show all components" |
| Open Source group | "show open source components" |
| Third Party group | "show third party components" |
| Private group | "show internal components" |
| Unknown component group | "show unknown components" |
| Security Posture Distribution total | "show all security posture checks" |
| Critical group | "show critical security posture checks" |
| High group | "show high severity security posture checks" |
| Medium group | "show medium severity security posture checks" |
| Low group | "show low severity security posture checks" |
| Unknown severity group | "show unknown severity security posture checks" |
FAQ & Troubleshooting
The panels briefly show all zeros when I open a component's Security Posture tab. At the component level, the panels first need to resolve the component's full subtree (itself plus every descendant component) before they can query counts. Stats loading is held until that resolution finishes, so a short zero/loading state right after navigating in is expected — it fills in once the subtree is ready.
A component's Security Posture numbers seem lower than I'd expect for how large its dependency tree looks. Subtree resolution is bounded so a pathological or extremely large dependency graph can't run away: it walks a maximum of 12 levels deep and stops collecting once it reaches 5,000 total component ids. On most components this is far more than enough, but an unusually deep or wide tree could see counts reflecting a bounded subset rather than the literal entire tree.
The percentages shown on the stat cards for a panel don't add up to exactly 100%. Each group's percentage is rounded independently, so small rounding differences (e.g., several groups each rounding up half a point) can make the displayed percentages sum to 99% or 101% even though the underlying counts are exact.
Clicking the "Private" component group sends a Griffin search for "internal" components — is that a bug?
No — it's an intentional (if inconsistent-looking) mapping. The panel labels the group Private, but the prompt it hands to Griffin AI Search is literally "show internal components". See the prompt table above for the exact wording sent by every group.
The Security Postures table says "No security postures found for this project/product/component." This reflects the table's current filters, not necessarily an absence of data — check whether any column filters are applied (via the filter/column controls) before assuming there's nothing to see, then use the refresh control to re-run the query.
I clicked Export on the Security Postures table but nothing downloaded. Exports are queued rather than generated synchronously — clicking a format (CSV, TSV, JSON, NDJSON, Excel, Parquet, PDF, XML, HTML, Markdown, or SQL) submits the export job and confirms it was queued; the file isn't streamed back immediately in the browser.
Improving Your Security Posture
Quick Wins
- Update critical dependencies - Fix critical CVEs first
- Enable AI Remediate - Auto-generate fix PRs
- Remove unused dependencies - Reduce attack surface
Long-term Improvements
- Establish a patching cadence - Regular update schedule
- Implement security gates - Block vulnerable deployments
- Improve SBOM completeness - Better component data
- Adopt attested packages - Use verified components
Related
- Vulnerabilities — detailed CVE-level data for the same components tracked here.
- AI Remediate — generate fix PRs for issues surfaced here.
- Policies & Gates — define and enforce security requirements across your components.
- Griffin AI Search — the natural-language search every panel group links into.
- Griffin AI — more on the model that powers that search.
- Explore SBOM — navigate the project/product/component structure this tab is scoped to.
- Risk Score (RS) — a related, separately-calculated component integrity score.
- Dashboard — organization-wide security overview.