AI Security Posture Score and Automated Investigations

Most security teams we talk to can answer "do we use AI?" in a sentence. Very few can answer "how exposed are we because of it?" without a week of spreadsheets. That second question is what AI security posture management is for, and it is what we rebuilt our console around this month: one AI security posture score for your fleet, a risk worklist that moves it, and investigations of risky agent sessions written for you, not by you.

The redesigned console is an opt-in preview for now. Turn on Try the new UX to use it, and switch back to the classic console whenever you like.

One AI security posture score, and what drives it

AI risk in a company isn't one thing. It is the AI apps people install, the accounts they sign in with, the MCP servers and skills those apps load, the secrets that end up where they shouldn't, and what agents actually do once they run. Each of those has its own list, and a list nobody ranks is a list nobody finishes.

The posture view puts them together. You get an overall score for your organization, a breakdown by risk area, so you can see whether your exposure is in the apps, the inventory, the secrets or what happens at runtime, and a short assessment that says, in plain words, what to handle first. When a CISO asks where we stand on AI, the answer is on one screen.

A score is only useful if it reflects decisions, not just data. So the score is driven by triage.

A risk worklist with real triage

Every finding lands in one risk worklist, and every finding gets a decision:

• Acknowledge: it is a real risk, you know about it, and it still counts against you until it is fixed.
• Snooze: not now. It comes back, and it still counts.
• Dismiss: not a risk for you. It leaves the worklist and stops counting.

That is the point of tying the two together. Acknowledging something doesn't make the number look better; fixing it or deciding it isn't a risk does. A team that triages honestly gets a score that tells the truth, and the next person to open the console sees what is still open, not what someone already looked at.

Behind each row is a drawer with the context to decide: the app, the asset, the endpoint, the user and the session, each one a click away from the others. Risk is also rolled up per user, so you can see who is carrying it, which is usually the conversation you need to have anyway.

Automated investigations of risky agent sessions

Posture tells you where you are exposed. Sessions tell you what actually happened.

An AI agent session is a sequence of prompts, tool calls, commands and results, often hundreds of steps long. Reading one is slow; reading every risky one is a job nobody has time for. So we built automated session triage: start an investigation, and AI reviews the risky AI-agent sessions in scope and writes a concise report for your security team.

The report reads like an analyst's handover, not a log dump: what the agent did, why it matters, and what we recommend your team do about it. You can watch an investigation while it runs, and come back to the report when it is done. The point is to spend your analysts' time on decisions, not on reading transcripts.

If you want to know what these sessions look like in practice, our post on MCP as the place where AI risk becomes real is a good start.

A console built around the work

The preview isn't a fresh coat of paint. It is organized around what a security team does with AI risk every day:

• See the posture: the score, the areas behind it, and what to handle first.
• Work the list: one worklist for every finding, with acknowledge, snooze and dismiss.
• Drill in: drawers for every app, asset, endpoint, user and session, linked to each other.
• Investigate: AI-written reports on the sessions that deserve a closer look.

Why this matters now

The AI footprint of a typical engineering organization grows every week: new agents, new MCP servers, new skills, new accounts. As we wrote when we renamed the company, these agents act on their own, with your credentials and your data. Inventories and alerts are the start. What a security team needs on top is a way to rank the risk, decide on it, and show that the decisions are moving the number. That is what the posture score and the worklist are for, and what the investigations make possible at the scale agents work at.

You can read more about how we approach AI security posture management and AI agent monitoring on our site.

Try it

The fastest way to see your own posture score is on your own fleet. Start a free trial, install the agent on a few machines, and open the new console.