# Programs

A **Program** is an organization-wide security initiative that leadership tracks
toward a target — for example a post-quantum cryptography migration, a
phish-resistant MFA rollout, or a non-human-identity ownership drive. Where a
[risk score](./risk-scoring.md) tells you *where you stand today*, a Program
tells you *how a deliberate improvement effort is progressing* and what it is
worth.

Programs surface as the **Programs** widget on the Executive View
[workspace](../user-guide/generative-ui.md#persona-workspaces) in the
Generative UI, so a CISO can see every active initiative at a glance and open
any one for detail.

## What a Program tracks

Each Program is a card showing:

- **Status** — *On track* (green) or *At risk* (orange). At-risk Programs sort
  to the top so the ones that need attention are seen first.
- **Progress** — a percentage toward the Program's goal, with a progress bar.
- **Loss exposure prevented** — the annual loss exposure (in dollars) that
  reaching the Program's goal has already bought down, tying the initiative to
  the same [financial quantification](./risk-scoring.md#from-scores-to-loss-estimates)
  used across Mesh.
- **Owner and due date** — who is accountable and when it is expected to land.
- **Next milestone** — the immediate next step.

The widget header summarizes how many Programs are active; a tenant with none
sees a plain "No active programs" state rather than an empty card.

## Where progress comes from

For initiatives Mesh can measure directly, progress is **computed from your live
risk data** rather than hand-entered. Mesh links a Program to the risk rules and
[policies](./policies.md) it is about, then measures the share of in-scope
identities or assets that no longer trip those rules — so a post-quantum
migration's progress reflects the real proportion of assets that have moved to
quantum-safe cryptography, and it moves on its own as collection brings in fresh
state. Coverage is recomputed on a regular cadence.

Some initiatives aren't mechanically measurable from risk data; those track
progress from a value the Program owner maintains. Either way, the card reads
the same and the distinction stays behind the scenes.

## Opening a Program

Clicking a Program card opens a [focus frame](./investigations.md) with its
detail and an **Ask the agent** prompt — a pre-written question scoped to that
Program (for example, *"Why is this program at risk, and what is blocking its
next milestone?"*) that prefills the workspace chat for you to review and send.

The **post-quantum program** opens a dedicated crypto-readiness view: the share
of assets that are compliant, a count of quantum-vulnerable assets, a breakdown
of vulnerable assets by algorithm, and the crypto [policy](./policies.md) rules
in force (preferred versus prohibited algorithms and the transition deadline).
This is the same post-quantum picture the
[PQC dashboard](../user-guide/pqc-dashboard.md) presents in classic mode.

## Programs versus compliance frameworks

Don't confuse the two:

- A **Program** (Executive View) is a *company initiative* measured against your
  own risk data — an effort you are driving to a target.
- A **compliance framework** (Audit & Compliance workspace) is a *regulatory
  standard* — NIST, PCI, ISO — whose controls Mesh maps coverage against.

A Program may advance your standing under a framework, but they answer different
questions: "how is our MFA rollout going?" versus "how much of PCI do we cover?"

## Related concepts

- [Risk scoring](./risk-scoring.md) — the scores and loss estimates a Program
  moves.
- [Policies](./policies.md) — the rules a Program is measured against.
- [Remediation](./remediation.md) — how the individual fixes behind a Program
  get done.
- [Generative UI](../user-guide/generative-ui.md) — the Executive View workspace
  where Programs live.