Security Posture Assessment

Download SKILL.mdGet Murage How skills work

Open source. macOS, Windows and Linux.

At a glance

What it is

Comprehensive security posture evaluation covering vulnerability management, access controls, policy compliance, incident readiness, and security culture to produce an actionable security scorecard.

A skill is a written procedure a bot loads when a job calls for it. This one is a single file, SKILL.md, and the whole file is on this page.

File: SKILL.md
Length: 329 lines2,188 words, about 10 min read
Category: Securityapplication security
Level: Intermediate
License: Apache-2.0

More security skills.

The full skill.

The whole file, exactly as it downloads. Read it before you rely on it.

SKILL.md

329 lines · 2,188 words

Download

Security Posture Assessment

You are a senior cybersecurity consultant specializing in security posture assessments. Your role is to evaluate an organization's security across vulnerability management, access controls, network security, compliance, incident response, and security culture to produce a structured scorecard with prioritized remediation actions. You assess defenses as an attacker would probe them.

When to Use

Use this skill when:

User asks about security posture assessment techniques or best practices

Put this skill to work.

Questions.

What is the Security Posture Assessment skill?

Comprehensive security posture evaluation covering vulnerability management, access controls, policy compliance, incident readiness, and security culture to produce an actionable security scorecard.

How much does it cost?

Nothing. It ships with Murage, which is open source. Your bots run on the AI plan you already have.

Can I change it?

Yes. Open it in Settings → Skills to read, edit or duplicate it. Skill Guard scans it again after every edit.

Give your first job to Murage.

Download the app, connect the AI you already pay for, and tell your Chief of Staff what needs doing. Plan on about ten minutes from install to a working team.

Download Murage

No account needed · Runs on the AI plan you already pay for

Score	Criteria
1	No vulnerability scanning. Known CVEs unpatched for months. No patch management process.
2	Sporadic scanning. Critical patches applied within weeks. No tracking of vulnerability metrics.
3	Regular automated scanning. Critical patches within 7 days. Vulnerability tracking in place.
4	Continuous scanning across all assets. Critical patches within 48 hours. Risk-based prioritization. SLA tracking.
5	Real-time vulnerability detection. Critical patches within 24 hours. Automated patching where possible. Zero known critical/high CVEs in production.

Score	Criteria
1	Shared accounts. No MFA. Excessive permissions everywhere. No access reviews. Root/admin credentials shared.
2	Individual accounts. MFA on some systems. Permissions are overly broad. Annual access reviews.
3	SSO enforced. MFA on all critical systems. Least privilege attempted. Quarterly access reviews. Service account management.
4	Zero trust principles. MFA everywhere. Just-in-time access. Automated provisioning/deprovisioning. Privileged access management.
5	Passwordless authentication. Continuous access evaluation. Automated anomaly detection on access patterns. Full PAM. Certificate-based auth.

Score	Criteria
1	Flat network. No segmentation. Public-facing services directly accessible. No firewall rules. No encryption in transit.
2	Basic firewall. Some segmentation. VPN for remote access. Partial TLS coverage.
3	Network segmentation by environment. All external traffic encrypted. IDS/IPS in place. VPN with MFA.
4	Micro-segmentation. Zero trust network. DDoS protection. Network monitoring with anomaly detection. mTLS for service-to-service.
5	Software-defined perimeter. Full mesh encryption. Automated threat response. Network access requires identity verification at every hop.

Score	Criteria
1	No security testing. Known vulnerabilities in production code. No secure development practices.
2	Occasional penetration testing. Some input validation. No SAST/DAST tools. Security is an afterthought.
3	SAST/DAST integrated into CI/CD. Annual penetration testing. OWASP Top 10 addressed. Security requirements in design.
4	Security champions in development teams. Threat modeling for new features. Automated security testing gates. Regular pen testing.
5	Security-by-design culture. Continuous security testing. Bug bounty program. Automated remediation. Security metrics drive decisions.

Score	Criteria
1	Sensitive data unencrypted. No data classification. No DLP. Backups unencrypted and untested.
2	Some encryption at rest. Basic data classification started. No formal DLP. Backup encryption inconsistent.
3	Encryption at rest and in transit for sensitive data. Data classification policy. Basic DLP controls. Backup encryption enforced.
4	All data encrypted. Automated classification. DLP monitoring and alerting. Key management with rotation. Data retention policies enforced.
5	End-to-end encryption. Automated data discovery and classification. Advanced DLP. Customer-managed keys. Right to deletion automated.

Score	Criteria
1	No incident response plan. No designated responders. No forensic capability. Past incidents handled chaotically.
2	Basic IR plan exists but untested. Some designated responders. No playbooks. MTTR measured in days.
3	IR plan tested annually. Defined roles and escalation. Playbooks for common scenarios. MTTR measured in hours.
4	Regular tabletop exercises and simulations. Automated detection and triage. Forensic capability. MTTR under 1 hour for critical.
5	Continuous IR improvement. Automated response for common attacks. Red team exercises. Lessons learned systematically applied. MTTR minutes.

Score	Criteria
1	Minimal logging. No SIEM. No security monitoring. Attackers could operate undetected for months.
2	Some logging but not centralized. Basic SIEM with many gaps. High false positive rate. Limited retention.
3	Centralized logging. SIEM with correlation rules. Alert triage process. 90-day retention. Key events covered.
4	Comprehensive logging across all systems. SIEM with behavioral analytics. Low false positive rate. 12-month retention. Threat hunting capability.
5	Full visibility. ML-driven threat detection. Automated investigation workflows. Extended retention. Continuous threat hunting. SOAR integration.

Score	Criteria
1	No security awareness. No policies. Security is "someone else's problem." No executive sponsorship.
2	Annual security training. Basic policies exist. Limited executive awareness. Security seen as a blocker.
3	Regular security training with phishing simulations. Policies reviewed annually. Security included in risk discussions.
4	Security champions program. Continuous training. Security metrics reported to executives. Culture of shared responsibility.
5	Security is embedded in culture. Every team owns security. Gamified training with high engagement. Board-level reporting. Innovation-friendly security.

Score Range	Posture Level	Interpretation
4.5 - 5.0	Strong	Mature security posture. Focus on continuous improvement and emerging threats.
3.5 - 4.4	Good	Solid defenses. Address gaps in specific dimensions for comprehensive coverage.
2.5 - 3.4	Moderate	Basic defenses in place but significant gaps remain. Targeted investment needed.
1.5 - 2.4	Weak	Material security risks. A breach is likely without intervention. Urgent action required.
1.0 - 1.4	Critical	Severely exposed. Assume compromise may have already occurred. Emergency remediation needed.

Security Posture Assessment

More security skills.

The full skill.

Security Posture Assessment

When to Use

Put this skill to work.

Questions.

Give your first job to Murage.

Search murage.ai

Security Posture Assessment

More security skills.

The full skill.

Security Posture Assessment

When to Use

Put this skill to work.

Questions.

Give your first job to Murage.

Create a bot and use this skill.

Ask Ember to create the bot

Open the bot’s skills

Find Security Posture Assessment and switch it on

Ask the bot for the job

About this skill.

Questions to Ask First

Organization Context

Infrastructure Context

Process Context

Assessment Framework

Dimension 1: Vulnerability Management (Weight: 15%)

What to Evaluate

Dimension 2: Access Control and Identity (Weight: 15%)

What to Evaluate

Dimension 3: Network Security (Weight: 10%)

Dimension 4: Application Security (Weight: 15%)

What to Evaluate

Dimension 5: Data Protection (Weight: 15%)

What to Evaluate

Dimension 6: Incident Response (Weight: 10%)

What to Evaluate

Dimension 7: Logging and Monitoring (Weight: 10%)

Dimension 8: Security Culture and Governance (Weight: 10%)

Scoring Template

Results Interpretation

Recommendations by Priority

Immediate (This Week)

Short-Term (This Month)

Medium-Term (This Quarter)

Long-Term (This Half)

Report Template

Process

Output Format

Edge Cases

Example