From data inventory to prioritized exposure. In one view.
PostQKey scores every sensitive asset against 6 exposure dimensions and surfaces a prioritized remediation queue. No more alert floods. A ranked list your team can actually work through.
Six dimensions, one composite score.
Each dimension contributes a weighted component to the composite score (0 to 100). The goal is not to alarm on everything. It is to rank your actual risk so a security engineer with a finite number of hours knows where to start. CRITICAL findings at 90+ mean "drop what you are doing." LOW findings at under 30 are tracked, not triaged.
Classification sensitivity
PII and PHI score highest. Financial and confidential follow. Internal and public data score lower, adjusted by context.
Access breadth
How many identities have a path to this data store. More identities with access to a PII table = higher score. Considers both direct and inherited role chains.
Encryption at rest
Unencrypted stores containing sensitive data get a significant penalty. Encrypted stores with managed keys score better than customer-managed key stores with overly broad key access.
Public reachability
Is the data store internet-accessible without authentication? Public-read S3 buckets with sensitive data score maximum on this dimension regardless of other factors.
Data age
Newly created data with a high classification score often signals a pipeline that just started processing sensitive records. Old unreviewed data from 3+ years ago that nobody has audited also scores higher.
Activity recency
Has this data store been accessed recently? A PHI store that nobody has queried in 18 months raises questions about whether it is still needed, and whether anyone is monitoring it.
The exposure prioritization view.
| Asset | Classification | Access | Public | Score | Action |
|---|---|---|---|---|---|
| s3://payments-archive-2022 | FINANCIAL | Public read | 96 | Restrict ACL | |
| customer_emails / Snowflake | PII | 47 identities | 82 | Review access | |
| Salesforce ContactExport / Drive | PII | Domain-wide | 67 | Restrict sharing | |
| snowflake-claims-staging | PHI | 8 identities | 48 | Review roles | |
| redshift-analytics-reporting | INTERNAL | 12 identities | 19 | Monitor |
Request a posture demo.
See the exposure map against a real data environment. Viktor walks you through findings live.