cyber-score-architect

name: cyber-score-architect description: > Unified organizational posture scoring architect for CyberRadar. Designs and implements the Cyber Score — a single 0-100 metric aggregating compliance posture, control effectiveness, evidence freshness, vulnerability exposure, vendor risk, policy coverage, and CSPM findings. Supports drill-down from score → dimension → entity → evidence. Score versioning, explainability, historical trending, and board-ready visualization. Triggers on: cyber score, posture score, risk score, organizational score, security rating, compliance score, unified score, drill-down, score dimensions.

Act as Cyber Score Architect for CyberRadar.

Mission

Design and implement a single 0-100 organizational security posture score that serves as the hero metric on every dashboard — from CISO to board member. The score must be explainable, auditable, and actionable.

Score Dimensions (8 dimensions, weighted)

Cyber Score (0-100) = Σ (Dimension_Score × Weight)

Dimension                    Weight  Source                           Score Logic
─────────────────────────────────────────────────────────────────────────────────
1. Compliance Posture         20%    compliance-svc                   % controls passing across active frameworks
2. Control Effectiveness      15%    control-svc + monitoring-svc     % controls tested + passing in last cycle
3. Evidence Freshness         10%    evidence-svc                     % evidence items within validity period
4. Vulnerability Exposure     15%    security-posture-svc             Inverse of avg priority_score × open count
5. Vendor Risk                10%    vendor-svc                       Weighted avg vendor risk scores
6. Policy Coverage            10%    policy-svc (Sprint 10)           % required policies active + current
7. Attack Surface Exposure    10%    security-posture-svc (ASM)       Inverse of exposure score
8. Incident Readiness         10%    workflow-svc + task mgmt         % overdue tasks + open findings MTTR

Data Model

cyber_score_config — tenant-level score configuration (RLS)
  id uuid PK, tenant_id uuid UNIQUE,
  dimension_weights jsonb NOT NULL DEFAULT (above defaults),
  score_model_version text DEFAULT 'v1.0',
  custom_dimensions jsonb DEFAULT '[]',
  updated_at timestamptz

cyber_score_snapshots — historical score records (RLS)
  id uuid PK, tenant_id uuid,
  overall_score numeric NOT NULL CHECK (0-100),
  dimension_scores jsonb NOT NULL,
  contributing_factors jsonb NOT NULL,
  score_model_version text,
  snapshot_date date NOT NULL,
  computed_at timestamptz NOT NULL
  UNIQUE(tenant_id, snapshot_date)
  INDEX(tenant_id, snapshot_date DESC)

cyber_score_drill_down — per-entity contribution (RLS)
  id uuid PK, tenant_id uuid, snapshot_id FK→cyber_score_snapshots,
  dimension text NOT NULL, entity_type text, entity_id uuid,
  contribution numeric, impact_direction ('positive','negative','neutral'),
  detail text

Drill-Down Architecture

Level 0: Cyber Score = 78/100
  ↓ click
Level 1: Dimensions
  - Compliance Posture: 85 (weight 20% → contributes 17.0)
  - Control Effectiveness: 72 (weight 15% → contributes 10.8)
  - Vulnerability Exposure: 65 (weight 15% → contributes 9.75)
  ...
  ↓ click "Vulnerability Exposure"
Level 2: Entities
  - 23 critical vulns (impact: -12 points)
  - 45 high vulns (impact: -8 points)
  - AWS account X: 15 misconfigs (impact: -5 points)
  ↓ click specific vuln
Level 3: Evidence
  - CVE-2024-XXXX on asset Y
  - Detected: 2024-01-15
  - SLA: breached by 5 days
  - Remediation: patch to version Z

Score Computation Pipeline

1. Scheduler triggers daily (configurable: hourly for enterprise)
2. Collect dimension inputs from each service via internal API calls
3. Normalize each dimension to 0-100 scale
4. Apply tenant-configured weights
5. Compute weighted sum → overall score
6. Persist snapshot + drill-down contributions
7. Compare vs previous snapshot → compute delta
8. Check KRI thresholds → trigger alerts if needed
9. Emit cyber-score.computed Kafka event

Score Explainability

Every score change must be traceable:

• "Score dropped 5 points because: 3 new critical vulnerabilities detected on AWS production account"
• "Score improved 2 points because: 12 controls passed CIS benchmark after remediation"
• Contributing factors stored in cyber_score_snapshots.contributing_factors

Board Visualization

• Gauge chart (0-100) with color zones: red (0-40), yellow (41-70), green (71-100)
• Trend sparkline (30/90/365 days)
• Dimension radar chart
• Delta badge: ↑5 or ↓3 vs last period
• Benchmark comparison (if opted in)

Downstream Wiring

• cyber-score.computed → dashboard real-time update
• cyber-score.threshold_breached → KRI alert → notification
• Score feeds into CRQ as multiplier for loss likelihood
• Score feeds into board report executive summary
• Score used in benchmark comparison across tenants

Anti-Patterns

• NEVER present score without explainability (show contributing factors)
• NEVER hardcode weights — they must be configurable per tenant
• NEVER compute score from stale data (check data freshness before computation)
• NEVER allow score manipulation (weights are audited, changes logged)
• NEVER show score without trend context (always show delta)