HOW IT WORKS · POSTURE
Posture: how it works what the 0–100 score on an agent means
Posture is a 0–100 quality score Helmwart computes for every agent. It summarises how much of the agent’s threat surface has working mitigations attached, weighted by how severe each underlying threat is. This page explains where to find the score, what feeds it, how each finding earns credit, why severity moves the number more than count, and the one case where 100 doesn’t mean what it looks like.
Where you see posture
Two places put posture in front of you. Hover an agent on the canvas (without selecting it) and the rich popover that appears includes a POSTURE row near the bottom: a label, a horizontal bar, and the numeric value. Switch the canvas from the default Threats view to the Posture view and every agent card grows a small coloured pill in the corner with its score (green for healthy, amber for middling, red for poor). The default Threats view does not show posture on the cards; those corner badges are threat counts, not posture.
The right-drawer (the side panel that opens when you click an agent) does not surface posture as a labelled element. It carries findings, blast radius, controls placed, and properties. Posture lives in the hover and the lens.
Posture is a quality metric, not a verdict. A 92 does not mean the agent is safe; it means most of what Helmwart has identified on the agent has something attached to it.
What posture measures
For each agent, Helmwart collects every threat finding that applies to it. That includes findings tagged directly on the agent and findings tagged on any edge that touches the agent, because an edge into or out of an agent is part of that agent’s surface.
Each finding carries two pieces of information that feed the score:
- Its status: open, in progress, or mitigated. You set this when you attach a control or update one.
- Its base severity: info, low, medium, high, or critical. Set by the threat definition itself, not by you.
How each finding earns credit
- Mitigated: full credit. The finding has at least one control attached and the control is considered effective.
- In progress: half credit. A control exists but is incomplete, draft, or not yet effective.
- Open: no credit. No control attached, or the attached control is not yet doing anything.
The score is the percentage of total severity-weighted findings that have earned credit this way.
Why severity moves the number more than count
Severity sets each finding’s weight in the sum. A critical-rated finding weighs four times as much as an info finding, a high three times, a medium twice, a low one and a half times. Mitigating a single critical can move the number more than mitigating three low-rated ones.
This is deliberate. A long list of low-rated findings should not be allowed to dilute a critical that nobody has touched. The weighting forces the score to track where the real risk sits.
When 100 means “not assessed”, not “safe”
An agent with zero applicable findings comes back with posture 100 in the underlying data, but the display labels it not assessed instead of showing the number. The reason is honest: Helmwart’s threat rules did not match anything on this node. The surface has not been assessed; the surface has not been cleared.
Treat not assessed as a prompt to look at the agent more closely or to widen the threat rules that should be matching it. It is not a confirmation that the agent is fine.
Walking through one example
Picture an agent with three findings:
- A critical finding (weight 4), mitigated. Credit: 4 × 1.0 = 4.
- A high finding (weight 3), in progress. Credit: 3 × 0.5 = 1.5.
- A medium finding (weight 2), open. Credit: 2 × 0 = 0.
Total credit earned: 5.5. Total weight available: 4 + 3 + 2 = 9. Score: (5.5 ÷ 9) × 100 ≈ 61. The hover popover shows 61.
To move the number up, the cheapest action is to finish the in-progress high (adds 1.5 more credit, takes the score to 78). The most valuable action is to attach a control to the open medium (adds 2 more credit, takes the score to 83). The critical is already paid for.
Posture vs the △ PUO badge
Posture and the△ PUO badgemeasure different things and can disagree by design.
Posture is a continuous quality metric tracking how well the findings on an agent have been addressed. The △ PUO badge is a topology check that fires before any specific finding is rated: does this agent sit at the intersection of private data, untrusted input, and an outbound channel? An agent can have a posture of 92 and still carry the badge. An agent can have low posture and no badge, if its findings are bad but its capability set is narrow.
Treat the badge as a hard gate: fix it or accept the design risk. Treat posture as a continuous quality signal to track over time.