Core workflows

Board reports

A board report is the artifact that turns your security program into something executives can understand and act on. Radius360 drafts one from your live data in seconds.

What the board report contains

A generated board report covers:

Executive summary. Where the program stands, with the posture score and its trend.
Top risks. The most serious open risks, with their business impact.
Framework progress. Where each active compliance framework stands.
Integration health. What your connected tools are reporting.
What changed. Movement since the last report period.
Action items. Prioritized actions for the next 30 days.

How the posture score is calculated

The Security Posture Score is a 0 to 100 composite that rolls up four weighted inputs. The full breakdown lives at /docs/posture-score. Quick reference:

Input	Weight	What it measures
Compliance health	35%	Completed controls / total controls, pooled across every active framework.
Risk health	30%	Share of active risks that are critical or high, with criticals counted twice.
Task health	20%	Mitigation tasks: how few are overdue, and how many are actually getting done.
Evidence health	15%	Share of current evidence that is passing. Failing or stale rows pull it down.

Each input is a 0 to 100 subscore, then weighted and summed. The methodology version is stored on each snapshot. The result maps to a label for quick executive interpretation:

0 to 24: Critical. Major gaps, urgent remediation needed.
25 to 49: At risk. Significant gaps, active remediation needed.
50 to 74: Developing. Foundation in place, program work in progress.
75 to 100: Strong. Mature posture with consistent evidence and follow-through.

The score is recalculated whenever its inputs change (risk status, task progress, evidence collected, framework completion percent). Scheduled reports show the score as of the period they cover, with a delta against the previous period.

Why these weights?

Compliance (35%) leads because audit readiness is the most externally observable governance outcome. Risk (30%) is second because unmitigated criticals are the loudest signal of weakness. Tasks (20%) and Evidence (15%) measure operational follow-through: is the work getting done, and do the checks actually pass?

Methodology version is stored on every snapshot, so historical points stay tied to the formula that produced them. See posture score formula for the full math and rationale.

Opening your board report

Open Reports and click Generate Board Report. Radius360 drafts the report from your live data at that moment, so it reflects the tenant as it is now.

Workflow:

1
Click Generate Board Report. The generator opens on the Reports page.
2
Pick the period. Weekly covers the last 7 days, monthly the last 30, and quarterly the last 90. Then click Generate Report.
3
Review. Read every section. If the tone or emphasis is off for your organization, regenerate for a fresh draft.
4
Export. Download the PDF, or copy the report to the clipboard to paste into your own deck or document. The preview is exactly what the PDF will look like.

Why generate from live data?

A board report is a mirror of your program, not an artifact to be manufactured. Generating from live data means the report shows the current state rather than an out-of-date snapshot. When you download the PDF, you get exactly what you reviewed.

Editing and regenerating sections

The first draft will not be perfect. Radius360 writes in a plain, neutral tone that works for most boards, but you know your directors better than the AI does.

Click Regenerate for a fresh draft of the report, or Start Over to pick a different period. For line edits, copy the report to the clipboard and finish it in your own document.

Don't send the first draft

Generate the report, read it, and regenerate if the emphasis is off. The second or third pass is usually the one you send.

Branding and tone

For vCISO and MSSP users on plans that include white-label (Program and above), board reports can be white-labeled with the client's logo, color scheme, and document footer. Configure this from Settings, Branding per client.

Tone is configurable at the tenant level: "formal", "conversational", "technical". The default for most organizations is conversational. Formal reads like a consulting deliverable; technical assumes board members have security backgrounds.

Scheduled delivery

Reports can be scheduled from the Reports page. Pick a report type (Executive Summary, Compliance Report, Risk Register, or Posture Report), a weekly or monthly cadence, the day it goes out, and the recipients. Scheduled reports are generated automatically on that cadence and emailed to the list.

Scheduled reports send without a review step, so choose recipients with that in mind. Recent deliveries are listed at the top of the Reports page.

Other report types

Radius360 generates several other report types beyond the board report:

Audit package. The full evidence export for a specific framework. See the frameworks page.
Risk register export. A point-in-time export of the risk register as PDF.
Incident post-mortem. Generated from an incident record, with timeline, root cause, and follow-up actions.
Vendor risk summary. The current state of third-party risk across all tracked vendors.
Framework delta. What changed in compliance posture between two dates (useful mid-audit to show remediation progress).

PreviousFramework assessments Next Posture score formula