How to benchmark organizational security posture

​

Overview

Security posture benchmarking helps you understand how different parts of the organization compare from a security and compliance perspective. By analyzing health scores, active risk factors, policy compliance, and endpoint distribution across groups, you can identify areas that require attention and prioritize remediation activities. If endpoints are organized into logical Endpoint Groups (for example, by department, office location, business unit, or function), the platform allows you to compare their security posture and quickly identify groups with elevated risk levels.

​

Benchmark Endpoint Groups

1. Open the Dashboard page.
2. Locate the Critical Issues Rate widget.
3. Review the bubble chart that visualizes the relationship between endpoint group health and active risk factors.

• Each bubble represents an Endpoint Group.
• The number of bubbles corresponds to the number of endpoint groups available in the system.
• The X-axis represents the endpoint group’s Health Score.
• The Y-axis represents the number of Active Risk Factors within the group.
• The Bubble Size represents the number of endpoints in the group.
• The Bubble Color represents the group’s health category.

Groups located:

• Further left generally have lower health scores.
• Higher on the chart have more active risk factors.
• Large bubbles impact more endpoints and may represent a larger organizational risk.
• Small bubbles may indicate localized issues affecting a limited number of endpoints.

4. Click a bubble to open the Risk Factors page filtered for the selected endpoint group.
5. Review and remediate the risk factors contributing to the group’s lower security posture.

​

Benchmark the Organization as a Whole

​

Step 1: Review the System Security Posture Widget

Start with the System Security Posture widget. This collection of summary cards provides a high-level overview of security across all monitored endpoints. Available cards include:

• Current System Health
• Critical Endpoints
• Actual Risk Factors
• Online Endpoints
• Unprotected Endpoints

Unprotected Endpoints are endpoints that do not have an ESPM license assigned and whose security posture is therefore not being monitored. Each card displays aggregated information across all endpoints available to the user. Clicking a card opens the corresponding page with relevant filters automatically applied.

​

Step 2: Review Current System Health

The Current System Health widget provides an overall view of organizational security posture. The widget displays:

• The current overall health score
• The distribution of endpoints across health categories
• The relative number of healthy and unhealthy endpoints

Use this widget to quickly determine whether security posture is improving, stable, or deteriorating.

​

Step 3: Review the Risk Factors Summary Widget

The Risk Factors Summary widget helps identify the policies and controls contributing most to organizational risk. Switch between:

• Policies
• Controls

to analyze security posture from different perspectives. For each policy or control, review:

• Health Score
• Number of Active Risk Factors
• Number of Affected Endpoints

Enable the Only policies/controls with active risk factors option to focus on areas requiring immediate attention.

​

Analyze and Prioritize Remediation

Once you have identified areas of concern, prioritize investigation and remediation based on business impact. Common starting points include:

• Endpoint groups with low health scores
• Endpoint groups containing large numbers of active risk factors
• Critical endpoints
• Policies with low compliance levels
• Controls with poor health scores
• Endpoints generating the highest risk levels

For each identified issue:

1. Open the corresponding endpoint, group, policy, or control.
2. Review the active risk factors.
3. Investigate the root cause of each risk.
4. Follow the recommended remediation guidance.
5. Monitor health score improvements after updated probe results are received.

​

Key Considerations

• Benchmarking should be performed regularly to identify trends and emerging risks.
• Endpoint groups organized by department, location, or business function often provide the most meaningful comparisons.
• Health scores should be evaluated together with active risk factors to understand the true security posture of a group or the organization.
• Large endpoint groups with poor health scores may have a greater impact on organizational risk and should typically be prioritized.
• Benchmarking helps identify not only the most vulnerable endpoints, but also the most at-risk groups, controls, and policies across the organization.

​

Related