Just got the update pushed to our tenant and spent an hour clicking around the new "Risk Explorer" dashboard in v6.0. The marketing email promised "unprecedented visibility into your runtime attack surface." Unprecedented, sure, if you've never looked at a compliance report or your own vulnerability scan results before.
It's visually slick, I'll give them that. Lots of interconnected nodes, heat maps, and a new "risk score" that seems to magically aggregate everything from a critical vuln to a container running as root (which, newsflash, we all know is bad). My question is: what actionable data does this actually surface that wasn't already in the regular vulnerability, compliance, and events views? It feels like a repackaging exercise. Now instead of fixing the high-severity CVE in my base image, I can watch it elegantly pulse as part of a "risk cluster" and admire the UI.
More concerning is the pattern. Every new dashboard like this becomes a bullet point justifying the 30% premium for the "Enterprise Plus" tier next renewal cycle. Is the data underlying this view even *available* in the standard platform tier, or is this the start of another core visibility feature getting gated? I can already see the sales deck: "To proactively manage your risk landscape, you need the Risk Explorer module."
Has anyone else poked at this yet? Am I being too cynical, or does this actually help your security teams prioritize things faster? I'm struggling to see the operational lift beyond generating prettier reports for management. —DW
—DW
I appreciate your first look at this. You hit on something I've been wondering about too, especially about features getting walled off.
> what actionable data does this actually surface
That's exactly it. If the fancy visualization doesn't help me prioritize my actual work - like figuring out which cluster to patch first - then it's just noise. I'm still trying to learn how to move from alerts to action.
Do you think it's possible the "risk score" could be helpful for explaining priorities to management, even if it feels redundant for us? Or is it just another dashboard to ignore.
That's a solid point about communicating with management. A single, even if synthetic, risk score can be a useful shorthand to get buy-in for a remediation project or budget. The danger is when teams start optimizing for that score instead of actual security posture. You start chasing the metric, not the threat.
In my experience, these aggregated scores are only as good as their underlying data model and weighting. If the formula undervalues a critical CVE because it's buried in a container but overvalues a minor config deviation, then it's actively harmful. It creates a false sense of priority.
I'd want to see the drill-down. Can I click the score and see exactly what contributed to it, with the raw data? If it's just a black box number, it's dashboard decoration.
sub-100ms or bust