Measuring Cybersecurity Health with Top Analysis

Top Analysis tracks security metrics over time, providing a snapshot of your organization's cybersecurity health. It highlights trends, compares metrics to RAG thresholds, and helps prioritize key areas to strengthen security and stay ahead of threats.

The Top Analysis table includes four analysis types: Close to threshold, Far from threshold, Recent change, and Performance. Each type has two selectable tabs showing details of positive and negative changes.

You can expand the Top Analysis area to see how your metrics are performing across your organization. Click the Details button to expand the analysis sidebar.

Click a metric in the table to display more details, including which dashboards use the metric and all records within that metric.

Data-Driven Cybersecurity Health Analysis

Top Analysis shows gains or losses indicating important trends in your overall cybersecurity posture. The four analysis types provide a useful snapshot of where the most substantial improvements and setbacks have occurred over time.

Close to threshold

For all metrics covered by the Scorecard, list those closest to changing to pass or fail over seven days.

• Closest to passing: Show failing (red) metrics that are closest to passing (amber, or green if there is no amber threshold).
  This reveals metrics that may benefit from additional effort to lift their status and improve your overall performance.
• Closest to failing: Show passing metrics (green or amber) that are closest to failing (red).
  These metrics are at risk of failing and may need to be prioritized for remediation.

The Distance column shows the change in points needed to reach the threshold.

Far from threshold

For all metrics covered by the Scorecard, list those furthest from changing to pass or fail over seven days.

• Furthest from passing: Show failing (red) metrics that are furthest from passing (amber, or green if there is no amber threshold).
  This reveals metrics that may benefit from a long-term remediation strategy to lift their status and improve your overall performance.
• Furthest from failing: Show passing metrics (green or amber) that are furthest from failing (red).
  These metrics are at lower risk of failing and may not need to be prioritized for remediation.

The Distance column shows the change in points required to reach the threshold.

Recent change

For all Scorecard metrics, list those that have recently changed status to pass or fail over 90 days, in descending order of recency.

• Recently failed: Metrics that have recently switched from passing (green or amber) status to failing (red) status.
  This list is a valuable indicator of recent significant performance drops that are weakening your overall posture.

• Recently passed: Metrics that have recently switched from failing (red) to passing (green or amber).
  This list provides confirmation of successful efforts to bolster initiatives and provides detail of where improvements have taken place.

The Days in column shows how long since the metric has changed status.

Performance

List those Scorecard metrics that have experienced the biggest change over the period selected in the scorecard. 

Like Recent change, this list highlights metrics that have experienced significant changes over time. However, this list is purely based on value change and not status.

• The Loss column is always negative and shows the reduction.
• The Gain column is always positive and shows the increase.

Metrics with the biggest losses may be a cause for concern and prompt further investigation.