Skip to main content
View as MarkdownOpen in ChatGPTOpen in Claude

Programs

A Program is an organization-wide security initiative that leadership tracks toward a target — for example a post-quantum cryptography migration, a phish-resistant MFA rollout, or a non-human-identity ownership drive. Where a risk score tells you where you stand today, a Program tells you how a deliberate improvement effort is progressing and what it is worth.

Programs surface as the Programs widget on the Executive View workspace in the Generative UI, so a CISO can see every active initiative at a glance and open any one for detail.

What a Program tracks​

Each Program is a card showing:

  • Status — On track (green) or At risk (orange). At-risk Programs sort to the top so the ones that need attention are seen first.
  • Progress — a percentage toward the Program's goal, with a progress bar.
  • Loss exposure prevented — the annual loss exposure (in dollars) that reaching the Program's goal has already bought down, tying the initiative to the same financial quantification used across Mesh.
  • Owner and due date — who is accountable and when it is expected to land.
  • Next milestone — the immediate next step.

The widget header summarizes how many Programs are active; a tenant with none sees a plain "No active programs" state rather than an empty card.

Where progress comes from​

For initiatives Mesh can measure directly, progress is computed from your live risk data rather than hand-entered. Mesh links a Program to the risk rules and policies it is about, then measures the share of in-scope identities or assets that no longer trip those rules — so a post-quantum migration's progress reflects the real proportion of assets that have moved to quantum-safe cryptography, and it moves on its own as collection brings in fresh state. Coverage is recomputed on a regular cadence.

Some initiatives aren't mechanically measurable from risk data; those track progress from a value the Program owner maintains. Either way, the card reads the same and the distinction stays behind the scenes.

Opening a Program​

Clicking a Program card opens a focus frame with its detail and an Ask the agent prompt — a pre-written question scoped to that Program (for example, "Why is this program at risk, and what is blocking its next milestone?") that prefills the workspace chat for you to review and send.

The post-quantum program opens a dedicated crypto-readiness view: the share of assets that are compliant, a count of quantum-vulnerable assets, a breakdown of vulnerable assets by algorithm, and the crypto policy rules in force (preferred versus prohibited algorithms and the transition deadline). This is the same post-quantum picture the PQC dashboard presents in classic mode.

Programs versus compliance frameworks​

Don't confuse the two:

  • A Program (Executive View) is a company initiative measured against your own risk data — an effort you are driving to a target.
  • A compliance framework (Audit & Compliance workspace) is a regulatory standard — NIST, PCI, ISO — whose controls Mesh maps coverage against.

A Program may advance your standing under a framework, but they answer different questions: "how is our MFA rollout going?" versus "how much of PCI do we cover?"

  • Risk scoring — the scores and loss estimates a Program moves.
  • Policies — the rules a Program is measured against.
  • Remediation — how the individual fixes behind a Program get done.
  • Generative UI — the Executive View workspace where Programs live.