Core workflows

Board reports

A board report is the artifact that turns your security program into something executives can understand and act on. Radius360 drafts one from your live data in seconds.

What the board report contains

A generated board report has seven sections:

Executive summary. One paragraph summarizing posture, trend, and the single most important thing the board should know.
Security posture score. A 0 to 100 composite that rolls up risk register, framework completion, and incident trends.
Top risks. The five highest-severity open risks with status and expected remediation timeline.
Framework progress. Completion percentages for every active framework, with what changed this quarter.
Incidents. A chronological list of incidents in the period, with severity, containment time, and outcome.
Key metrics. MFA coverage, patch compliance, training completion, vendor review status, and other numbers your board will ask about.
What changed this quarter. A narrative of what improved, what regressed, and what is planned for next quarter.

How the posture score is calculated

The Security Posture Score is a 0 to 100 composite that rolls up six weighted inputs. The full breakdown lives at /docs/posture-score — quick reference here:

Input	Weight	What it measures
Compliance %	30%	Mean of completed_controls / total_controls across activated frameworks.
Risk score	25%	100 minus weighted open-risk count (Criticals × 15 + Highs × 8 + others × 3).
Task score	15%	Mitigation task hygiene; overdue tasks penalize 10 each, open others 3 each.
Evidence score	15%	active_evidence / total_evidence × 100. Stale or failed rows drag it down.
Policy score	10%	active_policies / total_policies × 100.
Incident score	5%	100 minus open_incidents × 15. Closed incidents don't drag.

Each input is a 0 to 100 subscore, then weighted and summed. Methodology version is tracked on each snapshot so historical trend charts stay accurate when weights are tuned. The result maps to a label for quick executive interpretation:

0 to 49: At risk. Significant gaps, active remediation needed.
50 to 69: Building. Foundation in place, program work in progress.
70 to 84: Healthy. Meeting baseline, room for depth in specific areas.
85 to 100: Strong. Mature posture with consistent evidence and fast response.

The score is recalculated whenever its inputs change (risk status, evidence attached, framework completion percent, incident opened or resolved). Scheduled reports show the score as of the period they cover, with a delta against the previous period.

Why these weights?

Compliance % (30%) leads because audit readiness is the most externally observable governance outcome. Risk (25%) is second because unmitigated criticals are the loudest signal of weakness. Task and Evidence (15% each) measure operational follow-through. Policy (10%) is a leading indicator. Incident (5%) is point-in-time, intentionally light so a bad week doesn't tank a multi-quarter trend.

Methodology version is stored on every snapshot. When weights change in a future release, the trend chart annotates the breakpoint and historical points stay accurate to their original methodology. See posture score formula for the full math and rationale.

Opening your board report

There is no "Generate Report" button. Every tenant has an always-on board report that Radius360 drafts automatically from live data. When you open Reports, Board Report, you are looking at the current version, refreshed against whatever state the tenant was in as of the page load.

Workflow:

1
Open Reports, Board Report. The current draft is already there. No waiting, no click.
2
Pick the period and audience from the controls at the top. Period choices are this quarter, last quarter, custom range. Audience choices are Board of Directors (non-technical narrative), Audit Committee (more specific on risk and controls), or Executive Team (in between). Switching either option re-renders the report in place.
3
Review. Read every section. Edit where the tone or emphasis is off for your organization. Regenerate individual sections if you do not like the draft.
4
Export. PDF, Word, or PowerPoint. The PDF is the most common output; PowerPoint is useful for boards that like to present from slides.

Why always-on, not generate-on-demand?

A board report is a mirror of your program, not an artifact to be manufactured. Always-on means when anyone (you, your co-operator, an executive with view access) lands on the page, they see the current state rather than an out-of-date snapshot. When you click Export, you export whatever is live at that moment.

Editing and regenerating sections

The first draft will not be perfect. Radius360 writes in a plain, neutral tone that works for most boards, but you know your directors better than the AI does.

Every section has an Edit and a Regenerate button. Editing keeps what is there and lets you modify inline. Regenerate asks the AI to produce a different draft of that section, optionally with a prompt like "make it more urgent" or "less jargon."

The third draft is the one you send

Generate the report, fix the two sections that sound off, regenerate them, then edit. The third pass is almost always the one you send. Do not send the first.

Branding and tone

For vCISO and MSSP users on Business or Enterprise, board reports can be white-labeled with the client's logo, color scheme, and document footer. Configure this from Settings, White-Label Branding per client.

Tone is configurable at the tenant level: "formal", "conversational", "technical". The default for most organizations is conversational. Formal reads like a consulting deliverable; technical assumes board members have security backgrounds.

Scheduled delivery

On Professional plans and above, board reports can be scheduled: weekly, monthly, or quarterly. Scheduled reports generate automatically on the configured cadence and are emailed to a named list.

Scheduled reports are always marked as drafts first. A human in your organization must approve before they actually send, so you never have an unreviewed report going to directors.

Other report types

Radius360 generates several other report types beyond the board report:

Audit package. The full evidence export for a specific framework. See the frameworks page.
Risk register export. A point-in-time export of the risk register as PDF.
Incident post-mortem. Generated from an incident record, with timeline, root cause, and follow-up actions.
Vendor risk summary. The current state of third-party risk across all tracked vendors.
Framework delta. What changed in compliance posture between two dates (useful mid-audit to show remediation progress).

PreviousFramework assessments Next Posture score formula