What are we governing, and how much can we see?

Assess rollout progress and confidence in this picture.

100 known endpoints running 4 AI coding tools, 5,621 sessions in this window. Qpoint sees 100% of those endpoints, from 100% at the start of the window. Devices that have never reported can't be counted.

the Inventory report

What risk needs leadership attention?

Identify areas needing priority or investment.

5 critical or high findings are open, the oldest open finding of any severity at 42 days. The backlog is shrinking, 16 to 7. The most active policy areas: Unsanctioned MCP server in use; Personal account is in use; Credentials must not be sent to a model.

the Findings report

Are protections working and response improving?

Assess recorded protection and progress, without claiming every attack was stopped.

3 findings were blocked and 6 only observed in this window. 21 were resolved, 5 days on average (MTTR, across 17). Recorded blocks don't show every attack was stopped.

the Findings report

Is governance posture improving?

See the direction without a misleading combined percentage.

• OWASP Top 10 for LLM Applications2 Enforce · 8 can only observe · 11 Observe · 4 Off · 7 exceptions
  40%

Enforcement Posture is how much of Qpoint's part is done for each framework, over the controls Qpoint can speak to. It isn't a compliance percentage, and frameworks aren't added together.

the Compliance report

Where is management attention needed?

Prioritize at the leadership level.

• 5 critical or high findings are open.
• 3 policies look ready for an Enforce pilot, which would increase protection. The Findings and Compliance reports show the evidence.

the other three reports