security posture

The overall strength of an organization's ability to prevent, detect, and respond to security threats — encompassing policies, technical controls, team capability, and process maturity. Security posture is often assessed on a maturity model from ad hoc to optimized. Investors, enterprise customers, and regulators increasingly evaluate security posture as part of vendor due diligence.

When you'd see it: Board risk reports, security assessments, SOC 2 readiness reviews, investor due diligence questionnaires.

Why it matters: Posture is the lagging indicator of security investment and the leading indicator of breach likelihood. Boards and executives use posture assessments to make resource allocation decisions.

Common mistakes: Equating compliance (passing a SOC 2 audit) with security posture. Compliance is a floor; posture reflects how much above the floor the organization sits.

Related CISO, SOC 2, threat model, vulnerability