CISO workflows
As a Chief Information Security Officer (CISO), you don't spend your day in Northstar triaging individual findings. Your job is oversight: knowing where your organization's risk stands right now, whether it's trending in the right direction, and whether you can show that to your board, auditors, and regulators when asked.
This page covers the parts of Northstar built for your view.
Your role in Northstar
Northstar organizes security data into three building blocks:
Observations (raw vulnerability detections and attack events).
Issues (a specific, fixable problem a developer can act on). AppSec engineers work in issues.
Incidents (a collection of issues serious enough to demand immediate SOC attention). SOC analysts work in incidents.
Your view sits above both issues and incidents. You use Northstar to answer questions about overall exposure, whether exposure is improving or getting worse, where the organization is exposed to real, active risk rather than theoretical risk, whether the program is delivering a return on the security tools you've invested in, and whether you can prove with records who changed what and when.
Northstar's Insights dashboard, Contrast score, and the audit log exist specifically to answer these questions without requiring you to work through individual tickets.
You also carry the governance and compliance side of the program. That means audit visibility into activity within Northstar itself matters to you as much as the security findings do.