The product's own user guide. Every screen shows Aldervane Health, a fictional organization. All data is synthetic.
2. Start with the Executive Brief
Where: navigation ▸ Executive Brief.
The question it answers
How exposed are we right now, is it getting better or worse, and what needs a decision today?
The Executive Brief is written for the person who has to decide, not the person who has to fix. It leads with one measured sentence, then the few decisions that sentence asks for, then the context behind them. It's computed from the same data as the detailed pages, so every number can be followed down to the findings behind it.
The headline: how exposed are we?
The banner at the top gives your posture: a colour, and a sentence saying what the colour means.
4 of 31 monitored hosts (12.9%) are showing a critical finding. At or above the 5% systemic threshold.
In plain terms: Ciphren collected 31 internet-facing systems in the last 30 days. That's yours and your key suppliers' together, because a supplier's exposed system can be the way into your data. Of those 31, 4 have at least one critical weakness, the most serious kind. The colour follows from that share:
| Colour | Means |
|---|---|
| Green (no critical exposure) | No monitored system shows a critical finding |
| Amber (critical exposure present) | Some do, but fewer than the systemic threshold (5% of monitored systems) |
| Red (critical exposure, systemic) | At or above the threshold. The problem is no longer one system; it's how systems are being run |
Amber can also come from something other than critical systems, such as a supplier with high-severity findings or a rise in relevant incidents. The lines under the sentence say which.
Why a share, not a count. Ten critical findings mean something very different for an organization with 20 systems than for one with 2,000. The share makes the light comparable over time and between organizations.
Why "standing exposure". The line under the sentence says the light is not a measure of adversary activity. It tells you what an attacker could use, not that anyone is using it. That's the right question for a posture brief. Threat activity lives in Incidents (chapter 7).
Four more lines complete the headline:
- By location: where your critical systems are, if your organization is set up with locations ("Medical Center 3 hosts"). The rest are your suppliers' or belong to no single location. Each name links to its findings.
- The worst supplier: which vendor carries a critical finding, and that it's on their side ("vendor-side").
- "Observed from outside · 31 hosts collected in the last 30 days": the reminder that this is the outside-in view, and its size.
- "0 of 4 confirmed by release-string comparison": see the next section.
"Confirmed", and why most findings aren't
Most findings are made from what a system announces about itself, such as "Apache Tomcat 9.0.30" in a web header, matched against the versions known to carry a flaw. That's strong evidence, and it's how every outside-in tool works. But a system can announce one version while running a patched build, because some vendors backport fixes without changing the version number.
A finding is confirmed only when the exact release (the full build string) was compared against the release that fixes the flaw, and still falls short. "0 of 4 confirmed" means none of the four critical findings has that extra proof yet. Treat them as very likely, not certain: have the owner check the system's real patch level first. Chapter 3 shows what an unconfirmed finding looks like up close.
The decisions: what needs doing today?
Under the headline, the brief lists actions that need your decision, numbered and in order. Each one says what to do and why, in a sentence:
- Escalate to your incident response lead: active critical exposure needs a named owner today.
- Confirm notification obligations: some situations, like a supplier breach involving patient data, trigger legal duties to notify. Decide who owns each one.
- Review vendor findings: names the suppliers with open findings.
- Changes between collections are coverage, not exposure: tells you when a change in the numbers comes from Ciphren seeing more of your estate rather than your estate getting worse. It keeps a growing picture from reading as a growing problem.
"Draft playbook" and "unreviewed". Which actions to recommend, and in what order, is sector-specific advice. The note under the actions says this sector's advice is Ciphren's own and hasn't yet been reviewed by a practitioner in the sector. Lines marked unreviewed are the ones that most need that review. The numbers are not affected. Everything the actions cite is measured; only the advice is marked, so you can weigh it.
What leadership needs to know: priority intelligence requirements
Priority intelligence requirements (PIRs) are the handful of questions your leadership most needs answered. For a hospital, that means questions like "Has a vendor that holds our patient data been breached?" Each card shows:
- The question, in the words leadership would use.
- A traffic light (red, amber or green), marked upstream. "Upstream" means the collection's analysis set it, not anyone using this page.
- The evidence: the stories and findings behind the light. Each one links to the item itself. Items marked out of scope were considered and judged not to be about you. They're shown so you can see the judgement was made.
- "4 evidenced of 5 upstream": the analysis tied 5 items to this question, and 4 of them are here for you to open and read. A light you can't check is one you shouldn't trust, so the count is always shown.
Why PIRs matter. They turn a stream of security news into answers to questions you've agreed matter. They also make the brief a conversation you can have with a board: "here are our four questions, and here's where each stands."
Suppliers, ownership and the headline numbers
Supply chain resilience grades each key supplier on what Ciphren can see of it:
| Grade | Means |
|---|---|
| Critical | At least one critical finding on the supplier's systems |
| Elevated | No critical, but at least one high-severity finding |
| Monitor | Some findings, none high or critical |
| Clear | No open findings |
The Vendor Registry and each vendor's page (chapter 6) use the same grade.
Findings by owner splits every finding into two piles: your own estate (systems you run, including affiliates you own, such as Aldervane's foundation) and your vendors'. The split matters because the response differs: your own findings go to your team, while vendors' go to the supplier, through your contract.
The headline figures:
| Figure | Means |
|---|---|
| New this week | Incidents in the last 7 days, and the change from the week before |
| Organizational context | Incidents in the last 30 days that name your organization or one you depend on |
| Critical gaps | Critical findings, with high-severity ones beside them. This counts findings: one system can carry several |
| Infrastructure monitored | Hosts collected in the last 30 days, and how many domains they sit on |
| Strategic priority | Organizations and people whose exposure score (MRI, below) is in the watch tier |
MRI stands for Mission Resilience Index. "Mission" means what your organization exists to do; for a hospital, patient care. MRI is a single exposure score for an organization or a person. It adds up the severity of the findings on the systems they're responsible for. For some, it also counts the exposure of organizations they depend on.
- The scale is open-ended: more exposure, higher score. It isn't a percentage. Aldervane itself scores 126.
- 70 or more puts an organization or person in the watch tier.
- Each profile shows what its score is made of (chapter 9). It's a way to rank attention, not a verdict.
What changed
Since last collection compares each organization with its previous collection: new subdomains, new findings, new technologies. Week over week compares your posture and your suppliers' grades with seven days ago. Two things to know:
- A rise in findings often means better coverage, not a worse estate: Ciphren saw more of you. The brief says which it is, as in the fourth action above.
- What changed (under each organization) opens the detail: which hosts appeared, which findings stopped being seen, and which software was upgraded.
Measured risks
Measured risks restate the findings as consequences you can explain to anyone, each counted in hosts and organizations:
- Email spoofing: domains with no SPF or DMARC record can be impersonated in email. SPF and DMARC are published
rules that tell other mail servers which senders are genuinely yours (chapter 8). A second line counts domains
whose DMARC is only monitor-only (
p=none): receivers are told not to act on a failure, so these aren't protected either. - Known-exploited flaw on a server: servers running software with a flaw that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) lists as exploited in the wild. That list is the KEV catalogue ("known exploited vulnerabilities"). These are the flaws attackers are using now. The card names the products, most severe first; and 1 more counts the ones it had no room for.
- Known-exploited library inside a web page: the same, for code libraries that run in visitors' browsers. They're dangerous only if the page passes untrusted content to them, and the card says so.
- Certificates expired or expiring: a lapsed certificate triggers security warnings for visitors and can break services.
- Unsupported software: software past its maker's end of support, which no longer gets security fixes. Aldervane has none measured.
Cards marked measured are counted directly from observations. The two known-exploited cards are marked exploited in the wild instead, because their weight comes from CISA's catalogue.
The rest of the page
Further down, the brief gives context rather than decisions:
- Highest-priority threats: the stories most relevant to you, most severe first. Chapter 3 follows one.
- Technology risk: the software behind your worst findings, such as "CVE-2020-1938 [KEV]: tomcat, 2 hosts". A short list of what to upgrade.
- Host severity profile: how many hosts carry a finding at each severity. A host with findings at several severities is counted under each, so the bars add up to more than the host count. "Informational … not scored" counts hosts with facts worth knowing that aren't weaknesses.
- Infrastructure surface: which cloud and hosting providers your estate and suppliers use, and how concentrated that is. HHI (the Herfindahl–Hirschman index, a standard measure of concentration) runs from near 0 (spread across many providers) to 1 (all on one). "0.26 — highly concentrated" means an outage or breach at one provider (here, AWS, with half the organizations) would affect much of your estate at once.
- Threat landscape and 30-day activity: incidents by type, and by day.
- Highest MRI scores: the organizations and people in or near the watch tier.
Why totals differ between pages
You'll see slightly different totals for the same organization on different pages. Aldervane's own findings, for example, read 86 on this brief and 83 in the Vendor Registry. All of them are computed from the same data, but each answers a slightly different question:
- Time window: some pages count everything currently held; others count the last 30 days.
- Unresolved names: findings on names that never resolved to a live system are listed, but left out of host counts and posture.
- Tentative matches: library matches based only on a file name are listed, but left out of posture and supplier grades.
- One organization or its affiliates: an organization's own profile counts that organization; "own estate" also counts its affiliates.
- Domains or subdomains: the brief counts registrable domains (
aldervanehealth.example); a profile counts every subdomain.
Where a page leaves something out, it says so in a note beside the number.
What to do with it
- In a leadership meeting: read the headline sentence, then the actions. Everything else is there to answer "how do you know?"
- Weekly: check Since last collection and Week over week. Is the share of exposed systems falling? Did a supplier's grade change?
- When something's red: follow it down. Every number links to the findings or stories behind it. Chapter 3 walks one example from start to finish.