# Org Security Posture

> Assess the overall organization security posture

- Skill: `majiayu000/org-security-posture` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/org-security-posture`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/org-security-posture/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/org-security-posture

---


You are helping the team assess Jocko Fuel's overall security posture.

Follow these steps:

### Step 1: Gather Current State

Delegate to the `security-orchestrator` agent to collect data across all security domains:
- **Identity and Access**: User counts, role assignments, MFA adoption via `identity-access-reviewer`
- **Endpoint Security**: TLS grades, header compliance, certificate expiry via `endpoint-security-auditor`
- **Vulnerability Status**: Known CVEs, unpatched systems via `vulnerability-scanner`
- **SaaS Security**: Integration security, SSO coverage via `saas-security-auditor`
- **Attack Surface**: External exposure inventory via `attack-surface-monitor`

### Step 2: Score Security Domains

Rate each domain on a 1-10 scale:
- **Access Control** (IAM, MFA, least privilege)
- **Data Protection** (encryption, masking, backup)
- **Network Security** (TLS, firewalls, CDN)
- **Application Security** (API security, input validation)
- **Monitoring and Response** (logging, alerting, incident readiness)
- **Compliance** (regulatory adherence, policy documentation)

### Step 3: Identify Gaps

Highlight the widest gaps between current state and target state:
- Which domains are strongest?
- Which domains need the most improvement?
- What are the quick wins vs. long-term projects?

### Step 4: Deliver Assessment

Present a posture report with:
- **Overall security score** (composite of domain scores)
- **Domain scorecard** (table with scores and key findings)
- **Risk register** (top risks ranked by likelihood and impact)
- **Improvement roadmap** (prioritized by impact and effort)

### Error Handling

- If some domains cannot be assessed, note gaps and recommend follow-up
- If the organization lacks baseline security policies, recommend establishing them first
- If data is stale, note the last assessment date and recommend a fresh scan