Frequently Asked Questions

What is my current security posture?

Your security posture in XPosture is the aggregate picture across every security tool and compliance framework you have connected: how many controls pass, which findings are open, and where the highest-severity gaps are. The Dashboard shows this at a glance.

How does XPosture help me prioritize?

XPosture provides remediation-priority guidance for your findings, so your team knows what to address first.

How is the compliance score calculated?

Compliance scores summarize your assessment results per framework and over time. Scoring is deterministic — the same inputs always produce the same score — and each score can be traced back to the individual check results that produced it, which matters when you need to show an auditor where a number came from.

Which compliance frameworks are supported?

CIS Benchmarks, NIST CSF, ISO 27001, SOC 2, PCI DSS, and HIPAA — with automated control mapping, gap analysis, score history over time, and evidence collection for audits.

How do I connect a new security tool?

Integrations → select your vendor → Configure Connection → run the first scan. See Connector prerequisites for what to prepare — and where a vendor's permission requirements aren't listed there, ask us for the current list before creating the credential. XPosture connects read-only and stores your credentials encrypted.

What if a data source fails or isn't licensed?

XPosture tells you. A failed scan or an unavailable signal is shown as exactly that — it is never silently treated as "no risk". This is a deliberate design rule: missing data must be visible, not flattering.

How do AI features handle my data?

AI in XPosture is used to explain and summarize your assessment results in plain language. How data flows depends on your deployment form and the AI provider configured for your tenant, and AI access can be restricted or disabled entirely per tenant. See Deployment options, and ask us for the data-handling specifics — including any AI-training and data-retention terms — of the configuration you're considering.