Uncover trends and take action with Key Drivers

Organizations often struggle to pinpoint the true cause behind trends due to the time and effort required to uncover the drivers of change. 

Panaseer’s AI-powered Key Drivers help cybersecurity teams to rapidly understand the root cause behind unexpected change through natural language. Security analysts can then act on data-driven decisions to stay on top of new risks and report with confidence on key business metrics. 

If you have any questions about the use of AI within the Panaseer platform, please refer to Panaseer's AI Principles or contact your CSM.

A natural language summary of changes in a metric

By automating the discovery of the root causes behind metric shifts, Key Drivers eliminate the guesswork and bias that often lead to inefficient or inaccurate decisions. It dramatically reduces the time needed to diagnose problems, enabling faster, more confident responses to cyber threats and compliance risks.

Editing Business Logic or Control Check conditions can affect which dimensions appear as Key Drivers.

For example, let's say that Key Drivers is assessing a rise in vulnerability detections and the BL Country attribute was changed mid-week, reclassifying UK as United Kingdom.
Key Drivers sees UK drop to 0 and United Kingdom rise to 100, making it seem like a key driver of change.

Accessing Key Drivers

We recommend using Key Drivers to investigate unexpected changes in established metrics that you actively report on or monitor. These metrics are likely to uncover real impacts on your business, rather than background noise.

Not all metrics are compatible with Key Drivers and some produce results that aren’t useful. If you see an error message displayed in the summary panel, refer to Why does my metric not display Key Drivers? for more details.

Panaseer delivers Key Drivers at metric level, and you can access them in two ways:

• From a dashboard, click the button on the selected metric to go straight to the Metric Data page, or

• from the Metric Catalog page, select the required metric from the list or search the catalog for the require metric. Click the Metric data button on the selected metric.

Whichever route you take to the Metric Data page, the Key Drivers panel is displayed to the right of the Metric overview.

The summary panel breaks down the drivers of change for this metric in natural language so that you can understand the root cause behind unexpected change. 

For example:

Device Type is 'User Device' has changed by -18 which contributes 52.9% to the change

This summary quickly identifies User Devices as a major contributor to the metric change, so you can report with confidence that user device coverage is an area for investigation. 

You can show and hide Key Drivers using the button at the top of the page.

Using Key Drivers for Percentage and Average metrics

Key Drivers can't be used to analyze changes in percentage or average metrics directly. However, if you open the Metric Data page for one of these metrics, you can select either the Numerator or Denominator to explore the drivers of change for those underlying values.

Choose Dimensions to breakdown the Key Drivers

Panaseer supplies some dimension defaults that apply to most metrics, but you can add or remove any dimension from the dropdown list to include in the analysis. 

Contact your CSM for advice on how to change the default dimensions.

Focus on top-contributing factors using filters

You can focus the Key Drivers panel further using the filters. Each of the top-contributing factors includes a filter button on the right-hand side.

Click a filter to narrow the summary down using the selected dimension. Using our previous example, if a top-contributing factor is defined as:

Device Type is 'User Device' has changed by -18 which contributes 52.9% to the change

You can focus on that device type by clicking the filter button, which changes the Metric overview to focus on just that factor.

Why does my metric not display Key Drivers?

Some metrics are not suitable for use with Key Drivers, such as those where each unique item is only counted once, regardless of how often it appears in a security tool. These are known as distinct count metrics, such as Devices with vulnerability detections.

The Show/Hide Key Drivers button is disabled for unsupported metrics.

If you see an error message displayed in the summary, the following table may help you to diagnose the problem. 

Select at least one dimension to generate Key Drivers.	Choose at least one dimension from the Dimensions dropdown to generate Key Drivers.
We were unable to determine any Key Drivers for the change in this metric.	Key Drivers are not generated in the following conditions: The absolute change of the metric is less than 10. The top driver contributes less than 20% to the overall change. The top three drivers in the results are defined by NOT statements only. The top three drivers all include more than three dimensions. Try changing the dimensions or time period to explore further.
This could be caused by missing data or incompatible dimensions. Try selecting different metrics or alternate dimensions.	Selecting some dimensions won't work if: they contain null values, or they represent a data set with over 25 unique values (high cardinality).