CISO tasks
As a Chief Information Security Officer (CISO), your oversight role includes the following focus areas:
Monitor your security posture
The Insights dashboard is what you see when you log in to Northstar, and it's also available any time from Insights in the left navigation. It's built to reflect your overall security health in one place, combining security coverage, compliance status, and threat exposure rather than making you assemble that picture yourself.
The dashboard gives you two views:
Trends: a fixed view showing top issues and incidents, plus a set of charts covering your program's progress over a selected time frame.
My Insights: a customizable view where you can add your own widgets. You don't need an editor permission to build one, just access to the applications you want to see.
You can also apply filters, such as time range, severity, deployment tier, or application, to any trend widget so the picture reflects the slice of your environment you care about most.
Understand the Contrast posture score
The Contrast posture score is the single number at the top of your dashboard. It uses an exponential-weighted algorithm to aggregate the total risk of open issues and incidents across every application in your organization, so a small number of severe, high-confidence problems will move it more than a large number of low-risk ones. See Contrast Score for more information.
The underlying Contrast score itself reflects the risk of a specific issue or incident at a point in time, calculated from Contrast's CVE Shield, SAST, IAST, SCA, ADR, and Observability technologies. That's what lets the posture score represent real, current risk instead of a static count of open findings.
Review top incidents and issues
From the Trends view on the Insights dashboard, the incident and issue lists surface the top five items by severity, with tabs to switch between the two. Selecting any item takes you to its full detail.
An issue is a container for everything Contrast knows about one underlying flaw in one application, something a developer can act on directly.
An incident is a step up in urgency: Contrast creates one automatically when an issue includes an exploited attack event. Most incidents require both a high severity score and an exploited or suspicious attack event together. An attack event by itself is only enough to create an incident in certain narrower cases.
Track program performance
Beyond the top-five lists, the Trends view includes charts built to show momentum rather than a single snapshot:
Incidents burn-up: progress closing incidents over the selected time frame.
Threat-related observations: volume of threats Contrast observed over that period.
Time to close incidents: average time to close, broken out by severity.
Issues burn-up: progress closing issues over the selected time frame.
Issues per rule: which security rules are generating the most open issues.
Time to close issues: average time to close, broken out by severity.
Together, these are what let you show, with data, whether the program is keeping pace with new risk or falling behind, which is usually the question leadership and the board actually want answered.
Review audit logs
Because you're accountable for governance as well as risk, Northstar keeps a record of activity you can review independently of the security data itself. See Reviewing audit logs for details.