From security evidence
to informed decisions.

This public guide contains no passwords, tokens or private client credentials. Workspace links require sign-in. Screenshots, when included, are reference views and may differ from your selected reporting scope.

No matching topics. Try “reports”, “sources” or “approval”.

01

Get started

Your organisation, one reporting workspace

Open Get started ↗

Sign in

Open /login and enter your account credentials. A successful sign-in opens your workspace. Use Sign out when you finish on a shared device; an expired session sends you back to sign-in.

Understand the hierarchy

365mesh is the organisation. Farmdeck, BroadSecure and Lucendus are departments. Shared services provide cross-department context. Reporting groups are optional groupings, not separate legal organisations.

Choose your starting view

My dashboard prioritises information for the selected reporting role. Whole of Organisation provides the broader executive view. Selecting a department opens its posture and underlying evidence.

Your workflow

1. Sign in, open Whole of Organisation, and check the reporting period.
2. Select a department, open a finding, and review its business impact and owner.
3. Open Executive reports to inspect the same scope before exporting.

02

Scope & reporting periods

Set the context before comparing results

Open Scope & reporting periods ↗

Reporting period

Use the header to choose the reporting month. Current-period views support authorised updates; earlier reporting archives are read-only. The selected period follows navigation and reporting.

Current evidence or approved snapshot

Current evidence reflects the selected reporting period. An approved snapshot preserves its evidence, scope and methodology. Return to Current evidence before changing records.

Department, reporting group and shared services

Scope and reporting-group selections intersect the selected role’s permitted departments. Include shared services when their dependencies are relevant. A narrower scope naturally changes totals.

Anonymised comparisons

Anonymised mode hides identifying details. Comparisons involving fewer than three departments are suppressed. Turn it off to access authorised record-level evidence.

03

Role-specific workspaces

A starting point for each responsibility

Open Role-specific workspaces ↗

Executive and portfolio

Executives review group exposure, assurance gaps and decisions. Portfolio users compare their authorised departments and shared risks.

Cyber analyst and department administrator

Analysts investigate findings, review ingestion and coordinate treatment. Department administrators focus on their department’s assets, sources and remediation.

Contributor, approver and assurance reviewer

Contributors prepare submissions. Independent approvers review and publish them. Assurance reviewers inspect evidence quality and framework mappings.

Platform administrator

This reporting persona accesses configuration and governance, without department security content. The header persona selector explores workflow responsibilities; it is separate from account and OAuth-client authentication.

04

Whole of Organisation

Read posture alongside coverage and confidence

Open Whole of Organisation ↗

Posture and key indicators

Review the posture gauge, critical findings, overdue actions and reporting coverage together. Use Why this score? to inspect the inputs, weights and excluded or missing measures.

Charts and movement

Use the risk distribution, maturity radar, domain comparison and period movement to identify areas needing attention. The likelihood × impact heatmap opens the risks represented by a cell.

Avoid misleading comparisons

A low reported finding count can reflect incomplete coverage. Missing maturity remains unreported, not zero. Check evidence dates and populations before interpreting a trend.

Your workflow

1. Set the reporting period and organisation scope.
2. Inspect priority risks and evidence gaps.
3. Open the relevant department or risk to identify accountable action.

05

Department Explorer

Compare departments, then investigate their posture

Open Department Explorer ↗

Compare like-for-like

Search and filter departments by risk or reporting status, sort the table, and select departments for comparison. Check completeness and evidence freshness before ranking them.

Department Cyber Posture

Open Farmdeck, BroadSecure or Lucendus for a scoped posture gauge, maturity summary, domain assessments, priority risks, services and findings.

Operational context

Farmdeck covers agricultural IoT and application services. BroadSecure covers video analytics and edge processing. Lucendus covers IT asset management, CMDB relationships and ITSM workflows.

06

Findings & exposure

Turn a technical observation into a decision

Open Findings & exposure ↗

Open the record

Findings show severity, status and priority. Open a record to inspect its affected component, department, asset, service and external exposure.

Why this priority?

The detail view explains the prioritisation rule, business impact, mitigating context, evidence and intelligence version. A match to exploitation intelligence does not establish compromise.

Trace the evidence

Review original provider severity, observation time, source references and verification status. An uncertain match should be investigated before treatment is escalated.

Your workflow

1. Open a high-priority finding.
2. Check the affected service, exposure and observed evidence.
3. Review the required remediation and linked owner; follow the action to track delivery.

07

Risks, assets & incidents

Connect exposure with service impact

Open Risks, assets & incidents ↗

Systemic risks

The risk register and heatmap reveal shared technologies or dependencies. Open a risk to review its assessment and linked context; ratings are distinct from individual vulnerability severities.

Assets and services

Use the inventory to connect hostnames, service ownership, criticality and department context. Service relationships help explain why similar findings can have different business impacts.

Incidents

Review incident severity, investigation status and affected department. Keep confirmed incident evidence separate from threat intelligence and exposure indicators.

08

Remediation

Keep accountability and technical closure separate

Open Remediation ↗

Manage an action

Open Manage, assign or update the owner, choose a work status and set a due date. Save using a role permitted to update that department.

Track overdue work

Use due dates and overdue indicators to focus the action queue. Review linked findings to determine whether technical validation is still outstanding.

Closure rules

Completing a work item does not automatically resolve the source finding. Verify the fix through source evidence and retain the distinction between work status and provider status.

09

Controls & assurance

Assess maturity with traceable evidence

Open Controls & assurance ↗

Assessment register

Review each Essential Eight control’s assessed level, basis and evidence date. Technical findings support the assessment; they do not automatically establish maturity or compliance.

Framework mapping

Create a candidate relationship with a framework version, rationale and supporting finding evidence. An independent reviewer approves or rejects it; withdrawal remains visible.

Interpret mapping carefully

IS18/ISMS alignment and MITRE ATT&CK relationships provide context. A technique mapping alone is not proof of control effectiveness.

Your workflow

1. Inspect an assessment and its date.
2. Review a candidate framework mapping and supporting evidence.
3. Use the authorised review workflow before treating it as approved.

10

Source catalogue

Understand accepted platforms and reporting coverage

Open Source catalogue ↗

Find a platform

Search by platform, source category or accepted data. Cards show assigned instances and departments; Catalogue only means no instance is assigned in the selected scope.

Inspect an instance

Open Explore source, then inspect an assigned instance. Review accepted record types, payload structure, sync state and evidence freshness.

Connector status

The current workspace uses simulated source adapters. Catalogue acceptance describes the intended integration contract; it does not mean a live vendor connection has been established.

Your workflow

1. Search for a platform or data category.
2. Open the platform and select a department instance.
3. Inspect its timestamps and sync outcome, then follow View ingestion runs.

11

Ingestion & collection

Follow each stage from input to reporting

Open Ingestion & collection ↗

Five responsibilities

Collection retains source timestamps. Validation checks schema and identity. Normalisation reconciles severity and duplicates. Enrichment adds context. Publication makes governed results available.

Mapping changes

A cyber analyst saves a draft and previews impact. An assurance reviewer approves it. An analyst activates it. Activation applies to subsequent ingestion and retains original provider severity.

Recurring collection

Configure an instance’s recurring interval, enabled state and outcome. Ingestion & mapping can run due schedules or advance the workspace clock. These controls exercise scheduled behaviour; they do not start live vendor polling.

Run outcomes

Accepted records enter the model; unchanged records are deduplicated. Rejected records fail validation. Unresolved identity matches remain quarantined until reviewed.

12

Department submissions

Prepare, review and publish assurance

Open Department submissions ↗

Prepare a draft

Choose the department contributor persona. Open a submission or download the JSON worksheet template, fill its required fields, and upload it. The supplied spreadsheet/CSV scenarios exercise validation; arbitrary spreadsheet ingestion is not available.

Resolve validation issues

Check department identity, assessment date, control definition, numerator and denominator. Correct missing denominators or inconsistent measurements before submitting.

Independent review

Submit the draft, then use the independent department approver to move it through review, approval and publication. The author cannot approve their own submission.

Publication

Only publication updates the assessment repository and executive reporting. Saving a draft or approving an unpublished submission does not update published measures.

Your workflow

1. Draft → correct validation → submit.
2. Independent review → approve or request corrections.
3. Publish → inspect the assessment and reporting changes.

13

Intelligence & Ask Posture

Explore evidence with its context intact

Open Intelligence & Ask Posture ↗

Knowledge and provenance

Threat intelligence & knowledge shows versioned guidance, advisories and source references. Check applicability and confidence before using an intelligence match to prioritise work.

Ask a supported question

Use a prompt such as Shared critical exposures, Overdue actions or Control assessment gaps. Responses follow the current scope and period, with links back to supporting records.

Current assistant behaviour

The current assistant uses deterministic local templates and rules; no external AI model is called. Proposed model-assisted correlation, control mapping and narrative features require further delivery and validation.

Human review

Review cited records before accepting an inference. Intelligence withdrawal changes current context; an approved report retains the knowledge version used at approval.

14

Dashboard studio

Create a personal reporting view

Open Dashboard studio ↗

Compose your view

Enter a dashboard name and add governed widgets such as critical findings, overdue actions, coverage, MFA, assets or incidents.

Arrange and save

Use Move up or Remove to adjust the view, then Save dashboard. Saved views belong to the selected reporting persona and department context.

Reuse safely

Load a saved dashboard from Saved views. Widgets inherit the current scope and access rules; a saved layout does not grant access to additional departments.

15

Executive reports

Produce a reproducible briefing

Open Executive reports ↗

Confirm the scope

Check the reporting period, department/group, shared-services setting and anonymisation before exporting. Review methodology and evidence limitations.

Approve a snapshot

Use Approve snapshot to preserve the current approved view. Reopen it from Approved snapshots to inspect the retained evidence and model, even after current data changes.

Export

Download JSON exports structured report data. Print / save PDF opens the browser print workflow. Check print settings and report contents before sharing.

Approved snapshot versus current evidence

A snapshot is a retained reporting artefact, not a live view. Return to Current evidence to inspect later changes.

Your workflow

1. Set context and review the report.
2. Approve a snapshot when the view is ready.
3. Export JSON or print to PDF; reopen the snapshot for reproducibility.

16

Structure & onboarding

Bring departments into reporting deliberately

Open Structure & onboarding ↗

Reporting structure

Navigate organisation, reporting groups, departments and service entities. Groups provide reporting views while service entities retain ownership and business criticality.

Onboarding plan

As a cyber analyst, create a department plan, select source categories and choose central, federated or hybrid handling. Record the readiness confirmations before activation.

Activation

Activation creates pending source instances and unreported assessments. It does not invent security observations or automatically connect external platforms.