Scheduled reports

Reports → Custom Reports → Scheduled Reports lists what your organization receives on a recurring basis and what the last run actually did. There is one report today: the weekly organization security digest.

The weekly security digest#

Off by default. Turn it on under Data & retention → Audit settings, and every Monday at 08:00 UTC the people who can read your organization's security report are emailed it.

It carries your organization score and how it moved over the week, how many members have no second factor, how many have never run a vault analysis, and how many credentials are weak, reused, aging or found in a breach.

It says nothing on a quiet week — and that is not a failure#

If nobody is left to chase — every member has run an analysis, nothing is at risk, nobody is missing a required second factor — and the score has not moved since last week, no email is sent. A good score on its own is not news; a week at a steady 100 is exactly the week this stays quiet for. A weekly message that says nothing teaches people to filter it, and then the one that matters is filtered too.

That creates a problem this page solves: silence in an inbox looks the same whether the digest had nothing to say or the job stopped running. So every Monday run of a switched-on digest, on a plan that includes it, is recorded, and the scheduled-reports screen shows which it was:

What you see	What it means
Accepted by our email provider for N people	The digest was handed over for every recipient, with that morning's posture snapshot as a recap
Our email provider accepted only N copies	The provider refused the rest. N counts only the ones it accepted
Could not be sent	The provider refused every copy. The next Monday tries again
Had nobody to go to	There was something to report, but nobody holds the permission it is sent to
Nobody received it — everyone switched it off	There was something to report, but every person who could receive it has switched it off for themselves. A choice, not a failure
Could not be prepared	Something failed while building it, so no copy was attempted. The next Monday tries again
Sending now	This week's digest is being handed to the provider. The result replaces this when it finishes
Stopped part-way	It started but did not finish, so nobody can say how many copies went out — some may have
A scheduled digest did not run	The report was on, but nothing at all was recorded for the last scheduled Monday. A fault on our side, never a quiet week
Nothing to report that week	It ran and deliberately stayed quiet. Working as intended
Never	It has not run yet — because it was only just switched on, or the first Monday since has not come

"Accepted" is deliberate: we know the provider took a copy, not that it reached an inbox.

The screen keeps only the last run. Earlier runs are in your audit trail — the screen links to them, filtered to this report — for as long as your audit recording and retention keep them.

"Did not run" is judged only against a Monday the report was already switched on for, and only a few hours after 08:00, once the weekly run has had time to reach every organization.

"Never" and "nothing to report" are deliberately not the same cell. Collapsing them would put you back where you started.

Who receives it#

Everyone who can read your organization's security report — resolved from the permission at send time, not from a stored list. That is the same decision that lets them open it: the permission from their role or granted to them directly, minus any explicit deny, on an account that can sign in. A locked or deactivated account, or a suspended member, is not sent it. A member who gains or loses that access is added to or dropped from the next Monday's send with nothing to maintain.

If you could not open the report, you are not emailed it. Deriving recipients any other way would be a second, looser answer to who may see your organization's posture.

Access is checked again just before each copy goes out, not only when the Monday run starts. Someone whose access is removed, or who switches the digest off, while it is being sent does not get a copy.

Nobody else receives it — a member whose role does not include that permission is never sent it. It carries counts about members, and they have their own My organization security page.

Switching it off for yourself#

A recipient who does not want the Monday email can stop their own copy under Account → Notifications, in the Organization reports card (shown only to people who receive the digest; see Notifications). It is also off for anyone who has switched off email notifications, or all notifications. This removes only you. The digest keeps running for everyone else, and only an administrator can turn it off for the organization.

The screen's recipient count leaves out people who switched it off, and shows how many did beside it, so a short list does not look like a missing permission. Every digest email links to the setting.

Send me a preview#

Send me a preview, on the digest's card, emails you the digest as it would read with today's figures. Use it to see what switching it on would send. It is marked as a preview at the top.

• Only you receive it. Nobody else is mailed, and no setting changes.
• It works while the digest is off, and on a quiet week. The preview then says the Monday email would not have gone out at all.
• One preview per person every 10 minutes. If our email provider refuses it, you can retry at once.
• Not available while your subscription is read-only: the button is replaced by a line saying so. Switching the digest off for yourself still works.
• Anyone who can open this page can send themselves one. They are exactly the people the Monday send mails anyway.
• While your organization records audit events, each preview is recorded in the audit trail as Weekly security digest preview emailed. It is kept apart from the run history, so a preview never counts as a Monday.

What it can never contain#

Counts and dates only — never which credential is weak, its name or its value. Those are encrypted on your members' own devices and have never reached our servers.

The ceiling is stricter here than on the screen, and deliberately so: an inbox is unencrypted, forwardable, and outside every permission check this product enforces.

Two figures are also reported carefully rather than as zeroes:

• A score nobody has measured reads "not measured yet", never 0. Nobody having run an analysis is not a catastrophic score.
• On a plan without breach monitoring, the breach count reads "not monitored", never 0. Nothing looked, which is not the same as nothing found.

Nothing is archived, and that is on purpose#

No copy of a sent email is kept. The screen's recap of the last run is that morning's posture snapshot, taken at 02:15 UTC, and it is labelled as that. The digest itself read Security posture live at 08:00, so if something changed in between — a member enrolled a second factor, say — the email and the recap can differ by exactly that change.

A stored rendering would be a second copy of numbers the product already holds, free to drift from the screen that is meant to be authoritative.

Turning it off#

One control, under Data & retention → Audit settings. The scheduled-reports screen links to it and does not duplicate it — two switches writing one setting is how two screens come to disagree about it. To stop only your own copy, see Switching it off for yourself.

Related#

• Security posture — the live report the digest summarises
• Audit & retention — the switch, and the audit trail that records each run
• Reports overview — everything else you can pull on demand