Security Metrics & Analysis

Understand your organization's security posture and track remediation progress over time.

Dashboard

The Dashboard provides a high-level view of your findings, remediation progress, and security posture. Important information may populate in the banner as shown below.

Use the In Project and Time Period filters at the top of the page to drill into project-specific metrics. [1]

Key Metrics

The following metrics are displayed at the top of the Dashboard:

• Average Time to Remediate (days) [2]
  The average number of days it takes your organization to remediate a finding published by Sprocket. All-time and 90-day comparison statistics are shown.
• New Findings [3]
  The number of new findings published in the selected time period, with a 90-day comparison.
• Open Findings [4]
  The number of findings currently open and not yet remediated, with a 90-day comparison.
• Closed Findings [5]
  The number of findings that have been remediated and closed, with a 90-day comparison.

Findings Distribution

The Findings Distribution section shows how your open, closed, or all findings are distributed across severity levels, remediation states, and time open.

Use the Open, Closed, All toggle to switch between finding Status types. [1]

Clicking a severity level navigates to a filtered view of your findings at that severity. [2] Clicking a state navigates to a filtered view of findings in that state.[3]

Security Score

Your Security Score is a letter grade calculated by Sprocket based on the current state of your findings. It reflects your organization's overall security posture at a glance. Your score is shown alongside an Industry Average, calculated from Sprocket's broader customer data and industry benchmarks, giving you context for how your posture compares.

Your score recalculates each time a finding is updated.

To view the full Security Score detail, click the Security Score widget on the Dashboard. [1]

Score History [2] plots your Security Score for up to the last 4 months. Gridlines mark grade boundaries, and the latest point shows your current score.

Score Factors [3] shows the four heaviest weighted factors in your score calculation:

• Number of Open Findings with Critical Severity
• Number of Open Findings with High Severity
• Number of Findings Pending Fix
• Wide Exposure (11 or more affected hosts)

Most Impactful Fixes [4] shows which specific findings, if remediated, would have the greatest positive impact on your grade. These findings are linked directly from the Security Score slide out. [5]

MITRE ATT&CK

Sprocket assigns MITRE ATT&CK framework IDs to all findings and attack narratives. This allows your team to review the level of testing coverage provided by Sprocket and communicate that coverage to internal stakeholders. To access the MITRE ATT&CK page, select MITRE ATT&CK from the left navigation under Reporting. [1]

MITRE ATT&CK mappings can be found in three places:

• Findings
  Findings display their associated MITRE ATT&CK ID as a tag, they can be filtered on in the findings list and are visible on the finding detail page.
• Attack Narratives
  Each attack narrative includes its associated MITRE ATT&CK tag. The narrative also indicates the level of detection your team should have observed as a result of the test.
• MITRE ATT&CK Page
  The full heat map provides a comprehensive view of Sprocket's testing coverage and results across all MITRE tactics and techniques.

Reading the Heat Map

Toggle Attacks with Heat Only [1] to filter the heat map to techniques that have associated findings or attack narratives. Use this view when reporting to stakeholders or reviewing coverage gaps.

The heat map organizes techniques by tactic column. Each technique card displays its MITRE ID [2] and the number of associated attack narratives and findings. [3]

Technique cards are color coded based on their combined heat score, calculated from attack narrative results and finding severity:

• Green: Low heat. Risk level between 0 and 0.5.
• Yellow: Moderate heat. Risk level between 0.5 and 1.5.
• Red: High heat. Risk level above 1.5.

Heat is calculated from two sources:

• Attack Narrative heat: The gap between the expected result and your logged actual result. A larger gap between expected and actual indicates higher heat.
• Findings heat: Based on severity. Informational (0), Low (1), Medium (2), High (3), Critical (4).

Exploring a Technique

Clicking any technique card opens a detailed view showing all associated findings and attack narratives. From this view you can navigate directly to any linked finding or attack narrative.