{"generatedAt":"2026-09-24T11:49:02.949Z","posture":{"value":0.616,"low":0.616,"high":0.616,"capped":false,"knownEstate":{"segment":null,"low":0.805,"mid":0.907,"high":0.96,"stale":false,"reason":"weighted over 3 networks","observed":294,"lastSeenDays":null},"coveredOfKnown":0.616,"controlsVerified":26,"controlsTotal":56,"explanation":"62% of the estate is both known and covered by rules (26 of 56 rule checks verified). 91% of the estate is known, so no posture number can be higher than that. True range 62–62%."},"queue":[{"kind":"risk","id":"risk:33","segment":"ot-plant-b","title":"Unknown devices in ot-plant-b","assignee":"tech-amal","exposure":12,"unobserved":0.32899999999999996,"score":23.922,"why":"stated 12, effective 15.948, above appetite","link":"/risks"},{"kind":"risk","id":"risk:34","segment":"corp-hq","title":"Laptop with customer data is lost or stolen","assignee":"tech-lina","exposure":12,"unobserved":0.049000000000000044,"score":18.882,"why":"stated 12, effective 12.588, above appetite","link":"/risks"},{"kind":"risk","id":"risk:35","segment":"cloud-prod","title":"Cloud admin account is phished","assignee":"lead-sara","exposure":10,"unobserved":0.03600000000000003,"score":10.36,"why":"stated 10, effective 10.36","link":"/risks"},{"kind":"incident","id":"incident:7","segment":"corp-hq","title":"our colleaage got phisshed by email","assignee":null,"exposure":6,"unobserved":0.049000000000000044,"score":9.441,"why":"severity 3, open, darkest network 5% unknown","link":"/incidents"},{"kind":"risk","id":"risk:36","segment":"corp-hq","title":"Repeat of: phishing","assignee":"tech-lina","exposure":9,"unobserved":0.049000000000000044,"score":9.441,"why":"stated 9, effective 9.441","link":"/risks"},{"kind":"task","id":"task:56","segment":"ot-plant-b","title":"Treat risk \"Unknown devices in ot-plant-b\" [risk #33]: effective 15.696 is above the appetite. Planned: mitigate. 69% of this network is kno","assignee":"tech-amal","exposure":4,"unobserved":0.32899999999999996,"score":5.316,"why":"33% of ot-plant-b unknown × treat task","link":"/tickets"},{"kind":"risk","id":"risk:32","segment":"corp-hq","title":"Unknown devices in corp-hq","assignee":"tech-omar","exposure":4,"unobserved":0.049000000000000044,"score":4.196,"why":"stated 4, effective 4.196","link":"/risks"},{"kind":"task","id":"task:60","segment":"corp-hq","title":"Treat risk \"Laptop with customer data is lost or stolen\" [risk #34]: effective 12.588 is above the appetite. Planned: mitigate. 95% of this ","assignee":"tech-lina","exposure":4,"unobserved":0.049000000000000044,"score":4.196,"why":"5% of corp-hq unknown × treat task","link":"/tickets"},{"kind":"risk","id":"risk:31","segment":"cloud-prod","title":"Unknown devices in cloud-prod","assignee":"tech-lina","exposure":4,"unobserved":0.03600000000000003,"score":4.144,"why":"stated 4, effective 4.144","link":"/risks"},{"kind":"task","id":"task:61","segment":"cloud-prod","title":"D3FEND D3-ACA Active Certificate Analysis [Detect]: apply to cloud-prod. Inputs satisfied: Certificate File","assignee":"tech-lina","exposure":3,"unobserved":0.03600000000000003,"score":3.108,"why":"4% of cloud-prod unknown × gap task","link":"/tickets"},{"kind":"task","id":"task:62","segment":"cloud-prod","title":"D3FEND D3-AEM Application Exception Monitoring [Detect]: apply to cloud-prod. Inputs satisfied: Application Failure Count Variable, Log, App","assignee":"tech-lina","exposure":3,"unobserved":0.03600000000000003,"score":3.108,"why":"4% of cloud-prod unknown × gap task","link":"/tickets"},{"kind":"task","id":"task:63","segment":"cloud-prod","title":"D3FEND D3-ANET Authentication Event Thresholding [Detect]: apply to cloud-prod. Inputs satisfied: Authentication","assignee":"tech-lina","exposure":3,"unobserved":0.03600000000000003,"score":3.108,"why":"4% of cloud-prod unknown × gap task","link":"/tickets"},{"kind":"task","id":"task:64","segment":"cloud-prod","title":"D3FEND D3-APM Application Performance Monitoring [Detect]: apply to cloud-prod. Inputs satisfied: Application Scan Time, System Application ","assignee":"tech-lina","exposure":3,"unobserved":0.03600000000000003,"score":3.108,"why":"4% of cloud-prod unknown × gap task","link":"/tickets"},{"kind":"task","id":"task:65","segment":"cloud-prod","title":"D3FEND D3-CA Certificate Analysis [Detect]: apply to cloud-prod. Inputs satisfied: Certificate File","assignee":"tech-lina","exposure":3,"unobserved":0.03600000000000003,"score":3.108,"why":"4% of cloud-prod unknown × gap task","link":"/tickets"},{"kind":"task","id":"task:55","segment":"ot-plant-b","title":"Ticket OPS-4471 names ot-plant-b-plc-001 (hostname) which no adapter, scan or human has seen. Confirm what you see.","assignee":"tech-amal","exposure":2,"unobserved":0.32899999999999996,"score":2.658,"why":"33% of ot-plant-b unknown × verify task","link":"/tickets"},{"kind":"task","id":"task:58","segment":"ot-plant-b","title":"Ticket OPS-4519 names 10.44.7.31 (ip) which no adapter, scan or human has seen. Confirm what you see.","assignee":"tech-amal","exposure":2,"unobserved":0.32899999999999996,"score":2.658,"why":"33% of ot-plant-b unknown × verify task","link":"/tickets"},{"kind":"task","id":"task:59","segment":"ot-plant-b","title":"Ticket OPS-4519 names cam-dock-09 (hostname) which no adapter, scan or human has seen. Confirm what you see.","assignee":"tech-amal","exposure":2,"unobserved":0.32899999999999996,"score":2.658,"why":"33% of ot-plant-b unknown × verify task","link":"/tickets"},{"kind":"task","id":"task:57","segment":"corp-hq","title":"Ticket OPS-4502 names 00:1b:63:84:45:e6 (mac) which no adapter, scan or human has seen. Confirm what you see.","assignee":"tech-omar","exposure":2,"unobserved":0.049000000000000044,"score":2.098,"why":"5% of corp-hq unknown × verify task","link":"/tickets"}],"darknessOwned":[{"person":"tech-amal","items":5,"darkness":1.645},{"person":"tech-lina","items":9,"darkness":0.363},{"person":"tech-omar","items":2,"darkness":0.098},{"person":"nobody yet","items":1,"darkness":0.049},{"person":"lead-sara","items":1,"darkness":0.036}],"segments":[{"id":"cloud-prod","name":"cloud-prod","known":{"segment":"cloud-prod","low":0.878,"mid":0.964,"high":0.99,"stale":false,"reason":"96% of this network is known (90 devices seen, at least 4% unseen)","observed":90,"lastSeenDays":1.0944448330208334},"openTasks":5,"openRisks":2,"openIncidents":0,"driftedControls":0},{"id":"corp-hq","name":"corp-hq","known":{"segment":"corp-hq","low":0.88,"mid":0.951,"high":0.981,"stale":false,"reason":"95% of this network is known (154 devices seen, at least 5% unseen)","observed":154,"lastSeenDays":1.079103464548611},"openTasks":2,"openRisks":3,"openIncidents":1,"driftedControls":0},{"id":"ot-plant-b","name":"ot-plant-b","known":{"segment":"ot-plant-b","low":0.442,"mid":0.671,"high":0.841,"stale":false,"reason":"67% of this network is known (50 devices seen, at least 33% unseen)","observed":50,"lastSeenDays":1.079111682488426},"openTasks":4,"openRisks":1,"openIncidents":0,"driftedControls":0}],"report":"# Security status, 2026-09-24\n\n**Posture: 62% (true range 62–62%).** 62% of the estate is both known and covered by rules (26 of 56 rule checks verified). 91% of the estate is known, so no posture number can be higher than that. True range 62–62%.\n\n## What we do not know\n- cloud-prod: 4% of devices unknown (90 known); 5 open tasks, 2 open risks, 0 open incidents, 0 slipped rules\n- corp-hq: 5% of devices unknown (154 known); 2 open tasks, 3 open risks, 1 open incidents, 0 slipped rules\n- ot-plant-b: 33% of devices unknown (50 known); 4 open tasks, 1 open risks, 0 open incidents, 0 slipped rules\n\n## Top 10 things to do next\n1. [risk] Unknown devices in ot-plant-b — tech-amal — stated 12, effective 15.948, above appetite\n2. [risk] Laptop with customer data is lost or stolen — tech-lina — stated 12, effective 12.588, above appetite\n3. [risk] Cloud admin account is phished — lead-sara — stated 10, effective 10.36\n4. [incident] our colleaage got phisshed by email — nobody yet — severity 3, open, darkest network 5% unknown\n5. [risk] Repeat of: phishing — tech-lina — stated 9, effective 9.441\n6. [task] Treat risk \"Unknown devices in ot-plant-b\" [risk #33]: effective 15.696 is above the appetite. Planned: mitigate. 69% of this network is kno — tech-amal — 33% of ot-plant-b unknown × treat task\n7. [risk] Unknown devices in corp-hq — tech-omar — stated 4, effective 4.196\n8. [task] Treat risk \"Laptop with customer data is lost or stolen\" [risk #34]: effective 12.588 is above the appetite. Planned: mitigate. 95% of this  — tech-lina — 5% of corp-hq unknown × treat task\n9. [risk] Unknown devices in cloud-prod — tech-lina — stated 4, effective 4.144\n10. [task] D3FEND D3-ACA Active Certificate Analysis [Detect]: apply to cloud-prod. Inputs satisfied: Certificate File — tech-lina — 4% of cloud-prod unknown × gap task\n\n## Who carries the unknown\n- tech-amal: 5 items, darkness 1.645\n- tech-lina: 9 items, darkness 0.363\n- tech-omar: 2 items, darkness 0.098\n- nobody yet: 1 items, darkness 0.049\n- lead-sara: 1 items, darkness 0.036\n\n_Every number above is computed only over devices some source has seen. Nothing here is more certain than the estate is known._"}