Overview of the Risk History Dashboard
The Risk History tab provides a log of all past and present security findings for a specific vendor. This gives you a clear and historical view of their security posture.
The dashboard helps you understand trends, identify recurring issues, and track remediation efforts.
Risk Severity Summary:
At the top of the page, you'll see a summary of the total number of findings categorized by severity: Critical, High, Medium, and Low.
This provides a quick snapshot of the current state of the vendor's security posture and the distribution of risk.
Risk Details Table:
The main table lists all the individual findings. Each row represents a specific security issue.
Finding: A concise description of the security issue (e.g., "Revoked certificate in use," "DMARC policy is private").
Risk: A description of the potential risk associated with the finding (e.g., "Susceptible to man-in-the-middle attacks," "Emails can be fraudulently sent").
Category: The security category the finding belongs to (e.g., Encryption, Email, Website).
Status: The current status of the finding (e.g., Passed, In Remediation, Failed).
Assets: The number of assets affected by this finding.
First Detected: The date when the finding was first identified.
Using the Dashboard:
Prioritize: Use the severity summary to focus on the most critical risks first.
Track Remediation: Monitor the "Status" column to see which issues have been addressed and which are still pending.
Investigate: Click on any finding to view its detailed history and additional information.
Accessing Risk Details
From the Risk History dashboard, click on any finding to open the detailed risk view, as shown in the visual.
This detailed view provides all the information you need to understand, communicate, and manage a specific security risk.
Risk Details Panel:
Finding: A clear heading describing the issue (e.g., "SSL not available").
Manage: The "Manage" button allows you to take actions, such as updating the status of the finding or assigning it to a team member.
Severity: The severity level of the risk (e.g., "Critical").
Category: The security category it falls under (e.g., "Encryption").
First Detected: The date when the issue was first found.
Assets Affected: The number of assets impacted by this risk.
Status: The current status of the finding (e.g., "Failed").
Detailed Information Sections:
Summary: Provides a detailed, technical explanation of the finding, its potential impact, and why it is a security concern.
Risk Details: Offers a more in-depth description of the risk, its potential consequences, and what it means for your organization.
Recommended Remediation: Suggests specific steps or actions that the vendor can take to fix the issue. This is crucial for guiding the remediation process.
Affected Assets: Lists the specific domains, subdomains, or IP addresses that are impacted by this finding. This helps the vendor pinpoint exactly where the problem lies.
Taking Action:
Use this detailed information to create a remediation plan with your vendor.
Share the recommended remediation steps directly with them to help them address the issue efficiently.
