Window: last 30 daysScope: CISOData as of 21 Aug 2026 16:40 UTC
Open vs contained
Click a slice to drill into the cases behind it
Open 3Contained 3
SourcesTicketing / SOAR
NIST phase distribution
Where the active caseload sits
SourcesTicketing / SOARSIEM
Automation rate
64%
24% required human approval
SourcesTicketing / SOAR
Benign-closed
16%
Verified, not suppressed
SourcesTicketing / SOARCloud
Detection & response trend
Twelve weeks, derived from case timestamps
SourcesTicketing / SOARSIEM
ATT&CK coverage summary
70% average technique coverage · 7 techniques below 60%
SourcesSIEMEDR / XDRFirewall / NDRCloud
Connector health
Simulated sources the agent consumes — it never replaces them
Residual risk trend
Composite of open findings, exposure and incident load
Now
30
4 weeks ago
40
SourcesVuln MgmtCMDBTicketing / SOAR
Compliance flags
Generated views only — no filing is performed
Outcomes
What the governed agent changed
Faster detection
MTTD down from 45 to 16 minutes
Analyst productivity
64% of low/medium work automated
Consistent response
3 destructive actions held at the gate right now
Risk reduction
Residual risk 58 → 30
Audit trail
Everything the agent saw, decided and executed