Security reports

Security reports summarize the health of the credentials stored across your organization so you can find weak spots before an attacker does. They live under Reports → Security in the console sidebar.

Password strength#

Password strength breaks analysed credentials into five bands, each with a count and its share:

Band	Meaning
Strong	Nothing flagged by the last analysis. A remainder, not a separate measurement
Reused	Used in more than one place — as strong as the weakest place it is used
Aging	Older than your password policy allows
Weak	Too short or too predictable
Breached	Found in a known breach. Reads Not monitored where the plan does not include it

It shows counts only, never a credential — the weak/reused/breached flags are computed on each member's own device and uploaded as booleans, so the server has never held the password.

If nobody has run an analysis, the report says so and draws no chart. A distribution of nothing renders as a full green bar, which would be the most reassuring and least true thing this page could show. Members who have never been analysed are excluded from the percentages and named on the Security posture instead — their credentials are unknown, not strong.

Vulnerability assessment#

Vulnerability assessment sorts the same findings by how much they matter. Severity is our judgement rather than a measurement, so the rule is printed on the page itself:

• Critical — found in a public breach. The credential is already published, so rotate these first. Reads Not monitored where the plan does not include breach monitoring.
• Medium — weak or reused: guessable rather than known.
• Low — aging against the policy you set, and nothing else known against it.
• Nothing flagged — the remainder of what was analysed, not a separate measurement. It is measured against the checks your plan includes: without breach monitoring, a credential whose only problem is a breach has no finding to report and lands here.

Each credential is counted once, in the worst band it reaches. A password that is weak, reused, old and breached is one critical credential, not one in every band — so the four numbers always add up to the credentials analysed. The weak, reused, old and breached counts on Security posture are different: they count problems, and one credential can have several.

Critical links to Security posture's member table, narrowed to the members holding a breached credential, and the note under the bands links to the members who have never run an analysis.

Both reports read the same endpoint as the Security posture, so the three screens cannot disagree about the same organization.

Trend analysis#

Trend analysis charts your organization score, and three of the counts behind it — credentials at risk, credentials found in a breach, and members without a second factor — over 30, 90 or 365 days. Each count's tile shows its latest value and how far it moved over the window you picked.

Credentials at risk counts credentials, each once: a password that is both weak and breached is one credential at risk, not two. That count has been recorded since the nightly capture started keeping it, and days captured before then show as Not recorded — a gap, not a figure, because the older captures counted problems rather than credentials and the two cannot be drawn on one line.

Posture is captured once a night and kept for two years. That nightly capture is the only reason a trend can exist: PulsVault computes posture live, from the current state of your vaults, and the numbers describing any past day are gone once those vaults change. History cannot be backfilled — your first point appears after the first capture following the feature going live, not retroactively.

Three things the charts do deliberately, all for the same reason a bad chart is worse than none:

• A day with nothing measured is a gap in the line, not a zero. The line breaks rather than dropping to the axis, which would read as a collapse in posture rather than an absence of measurement. That holds for the credential counts too: on a day nobody had analysed, there is no count of weak or breached credentials to draw. The page counts the gaps under the chart, split by cause: days on which nobody had run a vault analysis, and nights on which no capture was taken.
• Time is drawn to scale. Each point sits on its own calendar day, so a missed night leaves a visible break instead of the days either side of it being pushed together.
• The score axis is pinned to 0–100, never fitted to the range of your data. An auto-fitted axis turns a two-point wobble into a cliff. The count charts always start at zero for the same reason.

Where the plan does not include breach monitoring, the breach figure reads Not monitored on the trend exactly as it does elsewhere, and the breach chart has a gap for those days — so a plan change mid-series does not render as a drop to zero that nobody caused.

What moved the line#

Dashed lines on the charts mark events that often explain a step: a plan change, a change to the organization's password or authentication policy, an administrator asking members to run an analysis, and a change in the number of members. Hover a line for what happened that day.

Policy changes and analysis requests are read from your audit log, so they appear only as far back as your audit log keeps them. Plan changes are recorded with each night's capture, so they are marked from the point that recording began.

Reading it another way#

• View as table, under the charts, lists every day with its score, counts, members analysed and events. It is the same data the charts draw, and the way to read them with a screen reader.
• Download CSV saves the window you are looking at. A day nobody analysed, and a breach count your plan does not monitor, are empty cells rather than zeros, so a spreadsheet average is not dragged down by numbers nobody measured.

Acting on findings#

1. Start with the Critical tier — a breached credential is already public.
2. Ask owners to rotate affected credentials using the built-in password generator.
3. Tighten requirements going forward with password & authentication policies.
4. Re-check the distribution after a rotation campaign. Both reports recompute on every read, so the change shows as soon as members re-run their analysis.