Security posture

The term is often used as an elegant synonym for “level of security”, which does not mean much. It is more useful to read it as the distance between the declared and the observed: what your policies say happens, and what can be verified as happening.

To be measurable it needs three elements: a set of indicators defined with their denominator — percentage of assets with critical patches current, against an identified inventory — a stable measurement frequency, and a time series. A single data point is not a posture, it is a snapshot.

The series adds the most value and is the most neglected. An 82 % that came from 61 % tells a completely different story from an 82 % that came from 94 %, and no tool will interpret that for you. It is also, in practice, the most direct way to answer the duty to assess the effectiveness of measures imposed by Article 21(2)(f) of NIS2.