FAQ

Company Settings

Q: What can I configure in Company Profile?
A: Company Profile settings allow you to manage general company information.

Q: What options are available under General Settings?
A: General Settings include configuring licensing, module entitlements, and license counts.

Q: How can I manage user access?
A: Manage user access through Users, Roles and access control, and Allowed email domains.

Q: What components are under Data capture?
A: Data capture involves managing Connectors and Sensors.

Q: How can Dashboards be customized?
A: Customize Dashboards through Default dashboards and Custom dashboards.

Q: What does Asset Inventory include?
A: Asset Inventory includes Sites and locations and Subnet to site mapping.

Q: What does Exposure Management cover?
A: Exposure Management covers Metrics and targets, Remediation SLA matrix, and Project/Ticketing Rules.

Q: What are the settings available under Cyber Risk?
A: Cyber Risk settings include Asset criticality, Control settings, and Risk scenarios.

Support

Q: What is the BX5 Asset Analysis?
A: It is a tool for accessing asset telemetry configuration, monitoring sensor deployment, and analyzing data sources.

Q: How does BX5 categorize assets?
A: It categorizes assets using predefined logic into on-premise and cloud types for better risk analysis.

Q: How can I contact support for BX5?
A: Use the contact form provided on the help page to reach support.

Implementing the CTEM Cycle with Balbix

Q: What is Continuous Threat Exposure Management (CTEM)?
A: CTEM is a proactive cybersecurity framework designed to continuously identify, assess, prioritize, and mitigate threats and vulnerabilities.

Q: What is the first step in the CTEM Cycle?
A: The first step is Scoping, which involves defining the attack surface beyond traditional infrastructure.

Q: What does the Discovery phase entail?
A: The Discovery phase involves identifying visible and hidden assets, vulnerabilities, and understanding their business context.

Q: How is Prioritization achieved in CTEM?
A: Prioritization involves making informed decisions on what to fix first, considering multiple factors like business risk and asset criticality.

Q: What is the purpose of the Validation phase?
A: The Validation phase involves verifying assumptions about security issues and understanding potential attack paths.

Q: What occurs during the Mobilization phase?
A: Mobilization involves turning security insights into action, coordinating people, processes, and technology for risk reduction.

Trend Chart

Q: What does the Trend Chart Widget display?
A: It displays how breach likelihood evolves over time, tracking changes in risk posture and spotting patterns or spikes requiring further investigation.

Q: How does this widget track breach risk?
A: It tracks how breach risk in US dollars changes over time to see trends and shifts in potential financial exposure.

Q: What does the asset count widget show?
A: It shows how the total count of assets changes over time, helping track growth or shrinkage in the environment and identify unusual fluctuations.

Q: How does the widget monitor risk score changes?
A: It shows how the overall risk score changes over time to monitor improvements or deteriorations in security posture.

Q: What does the MTTP widget measure?
A: It measures average duration between discovery of a vulnerability and application of a patch, helping understand response effectiveness to security issues.

Q: What indicates a high MTTP?
A: It may indicate bottlenecks in the patching process or insufficient resources.

Q: How do you evaluate MTTP impact?
A: By tracking MTTP over time to assess process improvements or new policies, ensuring faster vulnerability addressing.

Q: What does the MTTR widget measure?
A: It measures average duration from identifying a security issue to full resolution, covering the entire remediation process.

Q: What does MTTR help understand?
A: It helps understand delays in testing or validation and checks effective vulnerability closure.

Q: How does comparing MTTP and MTTR help?
A: It provides insight into patching speed and remediation workflow efficiency.

Q: What happens when no patch is available?
A: MTTP is irrelevant, but MTTR remains important for addressing vulnerabilities.

Q: What does a fast MTTP indicate?
A: It indicates an efficient patching process, while a fast MTTR signals strong overall security posture.

Q: What does MOVA widget track?
A: It tracks mean open vulnerability age, measuring days vulnerabilities remain unaddressed.

Q: What does upward MOVA trend indicate?
A: Longer remediation times or stretched resources, while a downward trend suggests improvement in closing vulnerabilities quickly.

Bar Chart

Q: What does the bar chart widget display about risk scores?
A: This widget displays the risk scores for specific asset categories or groups, using color coding to indicate severity (Low, Medium, High). In this example, both Linux/Unix Servers and Perimeter have a risk score of 89, categorized as high, helping you quickly identify and prioritize areas of greatest concern. Note that this widget will show the highest risk score found in the asset category.

Q: How does the bar chart widget help with breach likelihood?
A: This widget displays the likelihood of a breach for specific asset categories or groups, using color coding to indicate severity (Low, Medium, High). This comparison helps you quickly see which areas may be at greater risk of compromise and prioritize accordingly.

Q: What financial data does the widget display?
A: This widget displays the potential financial damage, in US dollars, that could result from a breach across different asset groups, helping you identify where a breach would carry the highest monetary consequences.

Q: What is the purpose of the breach risk widget?
A: This widget displays the overall breach risk, in US dollars, for each asset group or category. It helps you see where the financial exposure is greatest and focus your remediation efforts accordingly.

Q: How does the widget show asset distribution?
A: This widget displays the total number of assets for each group or category, allowing you to quickly see how your environment is distributed and where your largest concentrations lie.

Q: What does the vulnerability severity widget compare?
A: This widget displays a comparison of vulnerability severities—Low, Medium, and High—across different asset groups. It helps you identify which groups have higher concentrations of critical vulnerabilities and prioritize remediation efforts accordingly.

Donut Chart

Q: What does the Donut Chart widget display?
A: It displays an overall risk score in a color-coded donut chart, showing a numerical risk value surrounded by segments reflecting severity levels like Low, Medium, or High for a quick threat assessment.

Q: How does the asset breakdown in the Donut Chart help?
A: It provides an overview of asset counts by categories with color-coded segments, allowing a quick understanding of your environment’s composition and focus for security measures.

Q: What does the breach likelihood widget indicate?
A: It shows a numeric value indicating overall breach likelihood, with color-coded segments reflecting risk levels to help prioritize security efforts.

Business Outcomes

Q: What is a business outcome at Balbix?
A: A business outcome is a concise, defined, and observable result or change in business performance, supported by specific metrics.

Q: What does CAASM provide for cyber risk reduction?
A: CAASM provides foundational visibility capabilities essential for cyber risk reduction, including asset visibility, inventory, and vulnerability assessment.

Q: How does Balbix streamlining audit compliance reporting help?
A: It generates more accurate and comprehensive reports for asset inventory, security controls, and EOL software, reducing preparation time for audits.

Q: What is the impact of reduced operational overhead with Balbix?
A: It eliminates the burden of manual processes, allowing IT and cybersecurity teams to focus on strategic initiatives.

Q: How does Balbix enhance shadow IT management?
A: It reduces resistance to data collection from shadow IT and third-party systems, maintaining visibility over assets outside IT governance.

Q: How does improved CMDB accuracy benefit IT teams?
A: It enhances productivity by updating assets and attributes, addressing the challenge of CMDBs becoming outdated.

Q: What outcomes can be expected from RBVM implementation?
A: You can expect faster mitigation of critical vulnerabilities, enhanced compliance, cost savings, and improved vulnerability prioritization.

Q: What is the purpose of CRQ in cyber risk management?
A: CRQ helps measure, communicate, and manage cyber risk in monetary terms, improving project prioritization and stakeholder awareness.

Q: How does Balbix optimize security investments?
A: By consolidating tools, prioritizing activities, and ensuring the maximum return on security investments.

Connectors List

Q: What types of connectors are available?
A: There are various types including Cloud Connector, Cloud Native Application Protection Platform, IOT/OT, Risk Based Vulnerability Management, Flexible Connector, Endpoint Protection, and many more.

Q: What category does AWS belong to?
A: Amazon Web Services (AWS) belongs to the Cloud Connector category.

Q: What is required to set up an AWS connector?
A: You need to provide the Instance Name.

Q: What is the type of the Aqua Security connector?
A: The Aqua Security connector is a Cloud Native Application Protection Platform.

Q: What API parameters are used for the Armis connector?
A: Parameters include Instance Name, Armis Security Token, Asset last seen days filter, Armis API Base URL, and Armis Aql Filter.

Q: What do you need to connect to Azure?
A: You need Instance Name, Tenant ID, Client ID, Client Secret, and other specific API parameters.

Q: What asset management connector can be set up with an Org ID?
A: The Flexera connector allows setup with an Org ID.

Q: Which connector uses OAuth 2.0 for authentication?
A: ServiceNow Generic CMDB and Servicenow Ticketing both use OAuth 2.0 Login URL for authentication.

Q: Which connector is used for endpoint protection by VMware?
A: VMware Carbon Black is used for endpoint protection.

Q: What is required as API parameters for the Black Kite connector?
A: Required parameters are Instance Name, Client ID, Company Domain Name, API Base URL, and Client Secret.

BX5 Asset Analysis

Q: What can I access through the BX5 Asset Analysis settings?
A: You can access asset telemetry configuration, review sensor deployment status, track data ingestion sources, compare raw and deduplicated assets, evaluate asset data quality, identify incomplete telemetry, detect outdated records, monitor asset lifecycle, and navigate across different asset groups.

Q: What does the Configured Sensors count show?
A: It shows the number of configured sensors.

Q: What is the difference between Raw Assets and Analyzed Assets?
A: Raw Assets are the number of assets ingested before deduplication, while Analyzed Assets are the number after deduplication.

Q: What does the Categorized Assets table display?
A: It displays assets with sufficient data fidelity for accurate categorization.

Q: What are Assets with Poor Visibility?
A: Assets with insufficient data fidelity for accurate categorization, excluded from dashboards and risk calculations.

Q: What are Transient Assets?
A: Assets last observed more than 7 days ago (or 2 days for cloud assets), with both first and last observed times within the same day, excluded from dashboards and risk calculations.

Q: What are Recently Retired Assets?
A: Assets retired within the last 7 days due to lack of observations, excluded from dashboards and risk calculations. For assets observed only via Balbix sensors such as the Balbix Host Analyzer, the retirement period is 30 days—meaning the asset will be retired if the sensor has not reported any activity for 30 consecutive days.

Q: How is BX5's architecture designed?
A: It is built around data aggregation, deduplication, and AI-driven analysis, ingesting data from multiple sources and enriching it with contextual information for risk analysis.

Q: What is the purpose of data deduplication and normalization in BX5?
A: To eliminate redundant asset entries and standardize asset attributes for compatibility with analytical models and consistent risk scoring.

Q: How does BX5 enrich asset details?
A: By enhancing asset records with contextual information such as business impact, exposure level, and operational relevance for accurate risk prioritization.

Q: How does BX5 handle asset categorization?
A: It categorizes assets into on-premise and cloud types using predefined classification logic.

Q: What are Unverified Assets in BX5?
A: Assets lacking sufficient data for proper categorization, requiring customer verification or data augmentation.

Q: What is the outcome of BX5's asset processing?
A: It ensures clarity in asset fidelity, helping prioritize security initiatives and allocate resources efficiently.

Connectors

Q: How can I add new data sources to the platform?
A: Use the Add Connector workflow, select a connector from the Connector Cards, input details in the Connector Parameters form, and activate the integration.

Q: What is the Test Connection function used for?
A: To validate access.

Q: How can I define update intervals for data sources?
A: Use the Sync Frequency setting.

Q: Where can I view existing connector configurations?
A: In the Connector Details tab.

Q: How can I monitor integration activity?
A: By using the Sync History tab.

Q: What does the Sync Analytics tab display?
A: It displays data ingestion metrics.

Q: What is the purpose of Connectors?
A: To gather data from various external systems, unify it in one place, and keep it up to date continuously.

Create remediation projects

Q: What is a Remediation Project?
A: A Remediation Project includes multiple vulnerabilities that can be mitigated together, allowing security teams to track, prioritize, and manage vulnerabilities systematically to reduce overall risk.

Q: How can vulnerabilities be grouped in Remediation Projects?
A: They can be grouped by common criteria, such as severity, entity type, or affected system.

Q: What entities can you create remediation projects for with Balbix?
A: You can create remediation projects for various entities within your organization, including Assets and Applications.

Q: What are the benefits of using remediation projects?
A: Benefits include centralized management, prioritization of high-severity vulnerabilities, collaboration between teams, and auditing and reporting for compliance and risk management.

Using the Exposure Score Simulator

Q: What is the purpose of the Exposure Score Simulator?
A: It is designed to quantify and manage cybersecurity risks by assigning exposure scores ranging from 0 to 100 to identify, prioritize, and address vulnerabilities effectively.

Q: How does the simulator assist organizations?
A: It combines technical analysis with business impact assessment to guide decision-making and enhance risk mitigation strategies.

Q: What are some key benefits of using the simulator?
A: Organizations can focus resources efficiently, demonstrate security improvements, enhance compliance posture, and strengthen decision-making.

Q: What is the Exposure Score Framework?
A: It categorizes scores from low to critical, simplifying risk prioritization based on severity.

Q: How is the exposure score determined?
A: By analyzing dimensions such as vulnerability attributes, threat landscape, security controls, asset impact, and asset location.

Q: How does the simulator evaluate likelihood and impact?
A: Likelihood reflects probability of exploitation, while impact considers business consequences; combined, they form the exposure score.

Q: What are some mitigation scenarios modeled by the simulator?
A: Scenarios range from fully mitigated to high exploitation potential, demonstrating how various strategies affect exposure scores.

Q: How can users interact with the simulator?
A: By selecting vulnerabilities, assets, updating threat levels, adjusting security controls, and including simulation validation, users can refine their analysis.

Q: What visual insights does the simulator provide?
A: Dynamic visuals like Sankey diagrams and graphs illustrating exposure score changes over time, highlighting risk factors and mitigation effectiveness.

Create vulnerability filters

Q: What can you create in the Asset Vulnerabilities menu?
A: You can create filters and advanced filters for Unique Vulnerabilities and Vulnerability Instances.

Q: What attributes can be used to create filters?
A: Attributes include Publish Date, CVSS scores, CVSS severity, Threats, Vulnerability Tags, Has Ticket, Remediation Project, Exposure Score, Exposure Severity, State, Roles, Asset Tags, and various location-related fields.

Q: How do advanced filters apply boolean logic?
A: Within a group, attributes are evaluated as AND, while groups themselves are evaluated with OR.

Create automations

Q: What are automations in security tasks?
A: Automations streamline repetitive tasks by defining rules and actions, reducing manual effort, and ensuring consistency across security operations.

Q: How do automations identify assets or vulnerabilities?
A: Using filters and predefined criteria, automations automatically identify assets, vulnerabilities, applications, or findings that meet defined conditions.

Q: What actions can automations trigger once assets are identified?
A: They can trigger actions such as tagging, sending notifications, creating tickets, or generating exports to address risks or maintain compliance.

Q: What types of specialized automations does Balbix provide?
A: Balbix provides specialized automations for Assets, Asset Vulnerabilities, Applications, and Appsec Findings, offering targeted actions for distinct security requirements.

Q: What is the benefit of leveraging automations?
A: Leveraging automations increases operational efficiency, accelerates remediation, and aligns security processes with organizational policies and strategies.

Q: What are the types of automations based on element types?
A: The types are Asset Vulnerabilities Automation, Assets Automation, Applications Automation, and Appsec Findings Automation.

Q: What actions can Asset Vulnerabilities Automation trigger?
A: It can trigger actions like Send Slack, Send Email, Send Export, Create Ticket, and Create Remediation Project.

Q: What inputs does Applications automation use?
A: Applications automation uses only an application filter, which can be new or a saved filter.

Q: What actions can Appsec Findings automation trigger?
A: It can trigger actions like Send Export, Create Ticket, and Create Remediation Project.

Bix

Q: What is BIX?
A: BIX is a conversational AI-powered cybersecurity assistant built into the Balbix platform and available through the BIX iOS app, providing actionable insights into your organization's cybersecurity posture.

Q: Why should you use BIX?
A: BIX simplifies cybersecurity by providing fast and reliable answers to complex questions, helping stakeholders manage cyber risk effectively and empower organizations to strengthen their cybersecurity posture with confidence.

Q: What can you ask BIX?
A: You can ask BIX a wide range of questions about cybersecurity insights, such as top vulnerabilities in your environment, assets likely to be breached, mean time to remediate vulnerabilities, and more.

Q: Why use the iOS BIX app?
A: The iOS BIX app offers anywhere, anytime access to critical security insights, real-time responsiveness, and an optimized user experience.

Q: What key features does the iOS BIX app include?
A: Key features include security best practices, 24/7 availability, comprehensive search, chat history, push notifications, and email responses.

Q: What types of cybersecurity risks can BIX help me address?
A: BIX provides insights into various risks and exposures, including EOL systems, misconfigurations, unpatched vulnerabilities, insider threats, malware, and weak passwords, while suggesting next best steps.

Q: Can I report a security incident and create a remediation project using BIX?
A: Yes, you can report security incidents by describing the issue in the chat and instructing BIX to create a remediation project.

Q: What best practices can I follow to enhance my security posture?
A: BIX recommends best practices such as using strong passwords, enabling two-factor authentication, regularly updating software, patch management, deploying EDR solutions, and conducting employee security awareness training.

Access Request to Certification

Q: What is the Certified Balbix Specialist Certification?
A: It consists of 2 courses: Principles of Continuous Threat Exposure Management and Balbix User Course V2.

Q: What will I learn in Principles of Continuous Threat Exposure Management?
A: You will learn in detail how to implement the CTEM Cycle.

Q: What does Balbix User Course V2 cover?
A: It teaches how to use the Balbix Platform to implement the principles of the CTEM Cycle.

Q: How do I request access to the certification courses?
A: Please fill out the provided form to request access.

Board Reporting

Q: What is the purpose of board reporting?
A: To provide executives and board members with concise, relevant insights into company performance, risks, and strategic initiatives.

Q: How often should board reports be prepared?
A: Board reports are typically prepared on a quarterly basis, though frequency can vary depending on the organization.

Q: What key metrics should be included in board reporting?
A: Key metrics include financial performance, strategic progress, risk management updates, and relevant market trends.

Q: How can data visualization enhance board reports?
A: Data visualization can make complex data more accessible, highlight significant trends, and support data-driven decision-making.

Q: What role does narrative play in board reporting?
A: Narrative provides context, explains deviations from expected performance, and outlines planned responses to challenges.

Q: How should risks be communicated in board reports?
A: Risks should be communicated clearly, highlighting their potential impact and the actions being taken to mitigate them.

Q: What is the value of including forecasts in board reports?
A: Forecasts provide insight into potential future performance and support strategic planning and resource allocation.

Q: How can board reports drive strategic alignment?
A: By linking performance data to strategic goals, board reports reinforce alignment between operations and overall strategy.

Q: What challenges are associated with preparing board reports?
A: Challenges include ensuring data accuracy, maintaining confidentiality, and presenting complex information clearly and concisely.

Q: How can technology support effective board reporting?
A: Technology can streamline data collection, facilitate collaboration, and enhance report presentation through advanced analytics and visualization tools.

CYBER RISK SUMMARY

Q: What can you do in the Cyber Risk Summary menu?
A: You can view enterprise-wide cyber risk metrics, filter risk data by selecting different asset groups, analyze overall risk trajectory using the Risk Trend graph, interpret financial impact with the Loss Exceedance Curve, identify high-risk business areas through the Top Risk Business Groups visualization, examine control performance using the Top 10 Controls by Effectiveness chart, and access prioritized mitigation data via the CTEM Bird’s Eye link.

Q: What does the CTEM Birds Eye view present?
A: It presents a snapshot of your organization’s overall cyber risk in monetary units, breaking it down by distinct categories to show where vulnerabilities might be most critical, with each category represented as a branch from the central node.

Q: How is risk calculated in the Cyber Risk Summary?
A: Risk is calculated based on the scenario impact, which estimates the financial consequences of an incident, and the scenario likelihood, which reflects the probability of the event occurring.

Q: What does enterprise impact represent?
A: It represents the overall potential financial damage.

Q: What do exposures show in the Cyber Risk Summary?
A: Exposures show the level of risk present in the environment.

Q: How are Next Best Steps mitigation actions categorized?
A: They are categorized into Operational/Enterprise Management Actions, which address system vulnerabilities, and Control-Based Actions, which enhance security measures.

Q: What does the CTEM Birds Eye view provide?
A: It provides a holistic snapshot of your organization’s security posture, integrating data from multiple sources and visualizing the relationships among assets, applications, and exposures.

Q: What role do data sources play in the CTEM Birds Eye view?
A: Data Sources represent the various security and IT tools feeding information into the platform, contributing unique insights for a complete picture of your environment.

Q: What are assets in the CTEM Birds Eye view?
A: Assets are the individual entities being protected, such as servers, workstations, and IoT devices, assessed for risk profile based on collected details.

Q: What are exposures in the CTEM Birds Eye view?
A: Exposures are security gaps identified across assets and applications, prioritized to focus on the most critical issues first.

Q: How is cyber risk represented?
A: Cyber Risk represents the overall potential financial damage your organization could face if vulnerabilities were exploited, factoring in breach likelihood and impact.

Q: What does Dispatched for Automated Mitigation indicate?
A: It indicates exposures that the platform has routed to an automated process for remediation of routine tasks.

Q: What does Dispatched for Manual Mitigation refer to?
A: It refers to exposures requiring human review or intervention due to complexity or operational risks.

Q: What is the purpose of Exposures Deprioritized?
A: To deem issues low-risk or acceptable to leave unaddressed, ensuring the focus remains on critical exposures.

Q: What does Raw Assets Analyzed show?
A: It shows the total number of newly discovered assets, reflecting the thoroughness of asset inventory efforts.

Q: What does Raw Exposures Analyzed represent?
A: It represents the total number of exposures identified, indicating potential security gaps before prioritization or remediation.

Q: What is Work Avoided?
A: It is the estimated reduction in manual labor thanks to automated processes and intelligent prioritization, streamlining security operations.

Q: What does the Risk Trend graph display?
A: It displays expected financial risk due to cyber threats over time, with visibility into risk exposure trends and effectiveness of mitigation strategies.

Q: How is the Loss Exceedance Curve (LEC) used?
A: It assesses potential financial exposure to cyber risks, helping estimate likelihood of extreme financial losses for risk management and insurance modeling.

Q: How does the Top Risk Business Groups chart visualize risk exposure?
A: It visualizes the risk exposure of business units based on breach likelihood and potential financial impact, with color-coded risk levels.

Q: What does the Top 10 Controls by Effectiveness chart rank?
A: It ranks cybersecurity controls based on effectiveness, supporting decisions for cybersecurity strategy by prioritizing controls with the greatest return on investment.

Risk Settings

Q: Where can you find Risk Settings?
A: Risk Settings can be found at https://rs002tra.balbix.net/app/d3/cyber-risk/risk-settings.

Q: What can you do with CRQ Readiness Check?
A: Review organization's CRQ readiness using the Readiness Self-Assessment covering Inventory Coverage, Entity Categorization and Tagging, and Exposure Assessment Fidelity.

Q: What can be configured in Edit Enterprise Impact?
A: Edit enterprise-level risk valuation, configure risk impact categories, and view and validate predefined assumptions.

Q: What are some of the risk impact categories?
A: Incident & Response Costs, Data Recovery & Restoration Costs, Business Interruption Costs, Fines, Legal & Defence Costs, Financial Fraud, Physical Damage Costs, and Indirect Losses.

Q: What is the purpose of the Cost Assumptions List?
A: To view and validate predefined assumptions.

Q: What is performed in the Maturity Assessment tool?
A: Perform a detailed control maturity evaluation by selecting specific controls for evaluation and configuration.

Q: What are the modules you can configure in Risk Settings?
A: CRQ Readiness Check, Impact Settings, Assessment, and Other Settings.

Q: What is CRQ Readiness Check?
A: A non-binding questionnaire to assess readiness for CRQ.

Q: What can be configured in Edit Enterprise Impact section?
A: Groups, Currency, Industry type, Number of customers, Number of annual working days, Headquarters country, Annual revenue, Number of employees.

Q: What costs are included in Incident and Response Costs?
A: Notification Costs, Credit Monitoring Costs, Card Replacement Costs, Forensic Investigation Costs, Public Relations Cost, Average Employee Training Costs, External Cyber Experts Cost.

Q: What kinds of costs are categorized under Business Interruption Costs?
A: Business Downtime Costs, Direct Loss of Funds Costs, Monetary Theft.

Q: What is the objective of the Control Maturity Assessment?
A: To set the maturity level for various controls like Entity Management, Business Continuity, and recovering planning.

Q: What are the possible Maturity Levels?
A: Not implemented, Initial (Ad hoc), Repeatable (Managed), Defined (Standardized), Managed (Monitored & Measurable), Optimized (Continuous Improvement).

Q: What can you do in the Risk Settings section?
A: Review CRQ readiness, complete readiness assessments, edit risk valuations, configure impact categories, validate assumptions, review financial impacts, set impact values, evaluate control maturity, and configure specific controls.

Q: What is the CRQ Readiness Check?
A: A non-binding questionnaire to assess readiness for CRQ, covering inventory coverage, entity categorization, tagging, and exposure assessment fidelity.

Q: What can be configured in the Edit Enterprise Impact section?
A: You can configure groups, currency, industry type, number of customers, annual working days, headquarters country, annual revenue, number of employees, and firmographics.

Q: What costs can be configured in Risk Settings?
A: Incident and response costs, data recovery costs, business interruption costs, fines, legal and defense costs, financial fraud costs, physical damage costs, and indirect losses.

Q: What are some maturity levels in the Control Maturity Assessment?
A: Not implemented, Initial (Ad hoc), Repeatable (Managed), Defined (Standardized), Managed (Monitored & Measurable), and Optimized (Continuous Improvement).

Risk Analytics

Q: What is RISK ANALYTICS?
A: It is a process to identify, assess, and prioritize risks using data analysis, modeling, and assessment methods.

Q: How does it help businesses?
A: It helps in making informed decisions, improving risk management strategies, and enhancing organizational resilience.

Q: What tools are used in RISK ANALYTICS?
A: Tools include statistical software, data visualization platforms, and machine learning algorithms.

Q: What industries benefit from RISK ANALYTICS?
A: Industries such as finance, healthcare, and manufacturing benefit from improved risk assessment and decision-making.

Q: How does RISK ANALYTICS improve risk management?
A: By providing insights into potential threats, it allows organizations to implement proactive risk mitigation strategies.

Configure Company Profile and General Settings

Q: What parameters can be configured in the Company Profile?
A: You can configure Company Name, Company HQ Location, Company Industry Type, Company Employee Count, Company Revenue, Company Estimated Asset Count, Company Estimated Asset Count by Asset Type, and Company Estimated Sensitive Records Count.

Q: What parameters can be configured in the General Settings?
A: You can configure Current Deployment Phase, Locale, Default Mode, Risk Unit, Company Brand Color (Light Mode), Company Brand Color (Dark Mode), Maximum Records per Exported File, Risk Lower Limit, Impact Lower Limit, and Likelihood Lower Limit.

Widget List

Q: What is the purpose of the Risk Equation widget?
A: It displays a calculated risk value in US dollars, derived from multiplying the likelihood of a security incident by its potential financial impact.

Q: What does the Risk Composition widget show?
A: It shows a breakdown of risk posture across several risk categories, helping understand how each component changes when mitigation measures are applied.

Q: What information does the Vulnerabilities List widget provide?
A: It provides a searchable table of known vulnerabilities, sorted by maximum exposure score, helping prioritize vulnerabilities.

Q: How does the Vulnerability Summary widget assist?
A: It shows the total count of unique vulnerabilities categorized by severity level, aiding in prioritizing remediation efforts.

Q: What is displayed by the Security Controls ROI widget?
A: It displays the comparative risk before and after implementing security controls, showing risk reduction.

Q: What does the Controls Compliance Instances widget cover?
A: It displays how many controls have passed or failed compliance, providing a snapshot of compliance status.

Q: What details does the Next Best Steps widget list?
A: It lists prioritized remediation actions with estimated risk reduction, helping track impactful tasks.

Q: What insight does the Vulnerabilities Count Comparison widget give?
A: It shows total vulnerabilities for an asset group by severity, guiding focused remediation efforts.

Q: What does the Top Vulnerable Items widget show?
A: It displays items or vendors with the greatest number of known vulnerabilities by severity level, helping prioritize remediation.

Q: How does the Assets with Exposures widget help?
A: It displays assets and estimated breach risk, aiding in identifying and prioritizing critical assets.

Q: What does the Assets with Exposures by Site widget highlight?
A: It lists sites alongside unpatched asset counts, guiding remediation efforts to critical locations.

Q: What is displayed by the Assets with Exposures by Owners widget?
A: It lists owners with unpatched asset counts, focusing remediation on critical owners.

Q: How does the Vulnerabilities Instance Coverage widget assist in management?
A: It displays vulnerabilities by data source, spotting gaps or overlaps in detection.

Q: What information does the Asset List widget provide?
A: It displays discovered assets and potential breach impact, identifying high-cost compromise risks.

Q: What is shown in the Assets by Site widget?
A: It shows each site with asset counts, identifying largest asset footprints for focused security efforts.

Q: What does the Assets by Owner widget help with?
A: It shows owners with asset counts, aiding in focused security efforts on critical owners.

Q: What does the Asset Coverage widget compare?
A: It compares asset counts by data sources, spotting coverage gaps for a comprehensive asset view.

Q: What insight does the Software Inventory widget offer?
A: It displays top installed software packages by instance count, aiding in tracking patch levels and vulnerabilities.

Q: What does the Data Source Telemetry widget display?
A: It displays top data sources with covered devices, ensuring comprehensive security data coverage.

Q: What does the Asset Types widget breakdown show?
A: It shows asset breakdown by category, aiding in understanding environment composition.

Q: What does the Power Widget - Bar Chart - Risk Score widget show?
A: It displays risk scores for asset categories using color coding to indicate severity, helping prioritize concerns.

Q: What does the Power Widget - Bar Chart - Breach Likelihood widget compare?
A: It displays likelihood of breach for asset categories, helping prioritize risk areas.

Q: What does the Power Widget - Bar Chart - Breach Impact widget indicate?
A: It displays potential financial damage from breaches across asset groups, identifying high-consequence breaches.

Q: What information does the Power Widget - Bar Chart - Breach Risk widget provide?
A: It displays overall breach risk for asset groups, focusing remediation efforts on high financial exposure areas.

Q: What insight does the Power Widget - Bar Chart - Number of Assets widget offer?
A: It displays total assets per group, allowing environment distribution visualization.

Q: What does the Power Widget - Bar Chart - Vuln Summary widget reveal?
A: It displays vulnerability severities across asset groups, prioritizing critical vulnerabilities.

Q: What does the Power Widget - Trend Chart - Breach Likelihood widget track?
A: It tracks breach likelihood changes over time, spotting patterns or spikes.

Q: What insight does the Power Widget - Trend Chart - Breach Risk widget provide?
A: It tracks breach risk changes over time, gauging security improvements and potential threats.

Q: What does the Power Widget - Trend Chart - Number of Assets widget show?
A: It tracks asset count changes over time, identifying environment growth or fluctuations.

Q: What does the Power Widget - Trend Chart - Risk Score widget monitor?
A: It tracks overall risk score changes over time, assessing impact of new measures or threats.

Q: How does the Power Widget - Trend Chart - MTTP widget assist monitoring?
A: It tracks mean time to patch changes, evaluating patching process efficiency.

Q: What does the Power Widget - Trend Chart - MTTR widget measure?
A: It tracks mean time to remediate changes, measuring entire remediation process duration.

Q: What does the Power Widget - Trend Chart - MOVA widget show?
A: It displays mean open vulnerability age changes, ensuring proactive vulnerability management.

Q: What does the Power Widget - Donut Chart - Risk Score widget display?
A: It shows overall risk score in a color-coded donut chart for quick security posture assessment.

Q: What information does the Power Widget - Donut Chart - Number of Assets widget provide?
A: It provides asset count overview by category, aiding in understanding environment composition.

Q: How does the Power Widget - Donut Chart - Breach Likelihood widget help?
A: It visualizes breach likelihood, allowing quick urgency assessment for security efforts prioritization.

```

Configure Connectors

Q: How can connectors be added?
A: Connectors can be added either via API, or via file upload. API connectors will refresh automatically. File uploads are manual processes.

Q: Where can I see all the connectors?
A: You can see all the connectors in the Connectors List (https://help.balbix.com/docs/connector-list).

Configure Tag Manager

Q: How do you configure tags in Tag Manager?
A: In the Tag Manager menu, you can create your own tags to apply to assets, assign a tag color, and add attributes like impact level, asset zone, device type, and various owner types.

Q: What impact levels can be assigned to tags?
A: Impact levels can be mission critical, critical, high, medium, low, or none.

Q: What asset zones can be assigned to tags?
A: Asset zones can be core, perimeter, core-airgapped, core-internal, perimeter-DMZ, or perimeter-internet facing.

Q: What operations can you perform on tags?
A: You can search, edit, and delete tags.

Configure Users and Access

Q: What actions can you perform in the Users menu?
A: Add a user, assign role to a user, reset the password for a user, reset multi-factor authorization (MFA) for a user, remove user access, resend invite email to a user, delete a user account, edit users, send users a Bix instruction.

Q: What actions can you perform in the Roles and access control menu?
A: Add a role, view and edit roles, duplicate roles, delete roles.

Q: What actions can you perform in the Allowed email domains menu?
A: Add allowed email domain, remove allowed email domain.

Review Licensing

Q: What can I review in Module Entitlements?
A: You can review the activation and renewal dates for the modules you have access to.

Q: What can I view in License Count?
A: You can review your infrastructure count, application count, and user count. You can also request an increase in your license count.

Q: What information is available in Licensed Users?
A: You can review how many seats you have for exposure assessment, exposure management, and cyber risk quantification. You can also configure the seats.

Risk Equation Widget

Q: What does the Risk Equation widget show?
A: It shows how your total cyber risk is calculated using the formula: Risk = Likelihood × Impact, providing a live, dollar-based estimate of current risk exposure.

Q: How does the Risk Equation widget help assess risk reduction efforts?
A: By showing changes in likelihood and impact values as you patch vulnerabilities, reduce exposure, or improve security controls, providing a measurable way to track progress.

Q: How does the Risk Equation widget support decision-making?
A: It helps determine where to focus efforts by highlighting whether a high likelihood or impact is driving risk, aiding in prioritizing mitigation actions.

Risk Composition Widget

Q: What does the Risk Composition widget show?
A: It breaks down the financial structure of your cyber risk, giving visibility into the risk at each stage of your security posture, showing maximum breach impact, inherent risk, post-mitigation risk, and residual risk.

Q: What is Breach Impact?
A: It is the estimated financial loss if a significant security incident occurs with no controls, representing worst-case business disruption, data loss, penalties, and recovery costs.

Q: What is Inherent Risk?
A: It is the risk level before any security controls, reflecting raw exposure based on asset value, vulnerabilities, and threat landscape.

Q: What does Post Mitigation Risk represent?
A: It shows the remaining risk after accounting for current security controls like patching, segmentation, or endpoint protections, indicating risk reduction by existing controls.

Q: What is Residual Risk?
A: It is the final risk level after all known mitigations, controls, and risk transfer, which the organization must accept or further reduce.

Q: How can the Risk Composition widget aid decision-making?
A: By evaluating mitigation strategy effectiveness, showing risk reduction, helping justify control investments, demonstrating existing measures' value, and identifying areas needing action.

Assets with Exposures by Owners Widget

Q: What does the Assets with Exposures by Owners widget show?
A: It shows which owners are responsible for the highest number of unpatched assets in your environment, tying specific owners to a count of assets with known exposures to visualize accountability.

Q: How can the Assets with Exposures by Owners widget be used?
A: It can engage stakeholders, drive targeted action, implement gamification, and help coordinate efforts across departments by associating exposure counts with named owners.

Q: Why is the Assets with Exposures by Owners widget useful?
A: It aligns risk remediation with business context by addressing exposures through ownership and operational responsibility, useful for environments with distributed asset management or cross-functional teams.

Vulnerabilities Instance Coverage Widget

Q: What does the Vulnerabilities Instance Coverage widget show?
A: It shows the total number of vulnerability instances detected in your environment, categorized by data source, segmented by severity.

Q: How can you use the widget to assess detection strategy completeness?
A: By evaluating contributions from each source, identifying underutilized tools, integration issues, or limited visibility in specific infrastructure parts.

Q: How does the widget support validation and tuning of your data pipeline?
A: By comparing findings from different sources to identify enhancement areas for AI, consolidation engines, and additional integration work.

Vulnerabilities Count Comparison Widget

Q: What does the Vulnerabilities Count Comparison Widget show?
A: It shows the total number of vulnerabilities for a particular asset group, broken down by severity categories (Unknown, Low, Medium, High, Critical).

Q: How does the Vulnerabilities Count Comparison Widget help?
A: It helps you quickly identify where the bulk of your high-severity vulnerabilities lie, guiding more focused remediation efforts.

Security Controls ROI Widget

Q: What is the purpose of the Security Controls ROI widget?
A: It quantifies the financial value of your current security controls by comparing risk with and without them, presenting total risk reduction to show return on cybersecurity investments.

Q: What does "Without Security Controls" represent?
A: It represents the financial risk your organization would face if no security measures were in place, reflecting inherent risk from vulnerabilities and asset value.

Q: What does "With Security Controls" show?
A: It shows actual financial risk after applying the security controls currently deployed, reflecting risk after your defensive posture.

Q: How is "Likelihood" defined in the context of the widget?
A: It refers to the probability of a successful cyber incident, expressed as a percentage, showing how controls reduce the chance of exploitation.

Q: What is "Total Risk Reduction"?
A: It is the difference in financial risk between the uncontrolled and controlled states, quantifying the impact of your security investments in monetary terms.

Q: How can the widget help evaluate control effectiveness?
A: By showing risk and likelihood reductions, it indicates areas where controls prevent or contain threats, offering guidance on future investments.

Q: How does the widget assist in communicating with leadership?
A: By expressing control effectiveness in financial terms, it shifts conversation from technical details to business impact, aiding decision-making on future investments.

Controls Compliance Instances Widget

Q: What does the Controls Compliance Instances widget do?
A: It helps assess how effectively your security controls are being implemented across different control categories, with a breakdown of passed and failed checks.

Q: What is the purpose of the widget?
A: To provide immediate visibility into where controls are functioning correctly and where they are not.

Q: How can this widget be used?
A: To quickly identify areas needing attention, signaling gaps in control enforcement that could weaken your overall risk posture.

Q: Why is IG1 important in controls compliance?
A: A high failure count in IG1 indicates foundational issues that should be prioritized for remediation.

Q: How does the widget support decision-making?
A: By providing a consolidated view to focus on the highest-impact failures, improving control coverage and reducing exposure efficiently.

Assets with Exposures by Site Widget

Q: What does the "Assets with Exposures by Site" widget show?
A: It shows where unpatched or exposed assets are concentrated across your organization’s physical or logical locations, helping identify locations with the highest operational risk.

Q: How can the widget be used for remediation efforts?
A: It helps coordinate and prioritize site-specific remediation efforts, enabling targeted visibility to streamline coordination between security and operations teams across distributed environments.

Q: What alignment does the widget enable?
A: It aligns risk reduction efforts with organizational structure, providing a clear starting point for site-level initiatives based on exposed asset distribution.

Next Best Steps Widget

Q: What is the purpose of the Next Best Steps widget?
A: It helps prioritize remediation by listing impactful actions to reduce cyber risk, with an estimated financial risk reduction for each task.

Q: How does the widget support decision-making?
A: By comparing tasks based on technical urgency and potential return, aiding strategic decisions to reduce exposure.

Q: How can the widget assist in operational planning?
A: It guides planning by providing a prioritized list of recommended actions, simplifying management of vulnerabilities and misconfigurations.

Q: How is the widget organized?
A: It is organized into Proposed, In Progress, and Completed tabs to track remediation workflow and coordinate efforts across teams.

Q: What is the benefit of using the widget?
A: It turns risk insights into measurable action, ensuring accountability and monitoring progress effectively.

Assets with Exposures Widget

Q: What does the Assets with Exposures widget identify?
A: It identifies individual systems in your environment that carry the highest breach risk, listing a hostname and its associated risk value in monetary terms.

Q: What does the monetary risk value represent?
A: The potential financial impact if that asset were compromised.

Q: How does the widget help in risk management?
A: It helps pinpoint which assets contribute most to your overall risk posture.

Vulnerability Summary Widget

Q: What does the Vulnerability Summary widget provide?
A: It provides a high-level view of all unique vulnerabilities identified across your environment, grouped by severity level.

Q: How does the Vulnerability Summary widget help?
A: It helps you understand the overall scale of your vulnerability landscape and categorize it into critical, high, medium, or low categories.

Q: What does the count in the center of the Vulnerability Summary widget represent?
A: It reflects the total number of unique vulnerabilities, not instances.

Top Vulnerable Items Widget

Q: What does the Top Vulnerable Items widget highlight?
A: It highlights vendors or platforms with the highest number of known vulnerabilities, displayed with a severity breakdown from low to critical.

Q: What is the purpose of the horizontal bar in the widget?
A: The horizontal bar helps you quickly assess which products contribute most to your organization's vulnerability footprint.

Q: How can this widget assist in remediation efforts?
A: It allows focusing on vendors requiring immediate attention and aids in prioritizing remediation and vendor management efforts.

Q: What is signaled if Microsoft has the largest share of vulnerabilities?
A: It signals that patching or configuration processes for Microsoft products may need strengthening, especially in the medium to critical range.

Q: How does the widget support prioritization at the vendor level?
A: It makes it easier to coordinate bulk remediation across product lines and teams, tracking the effectiveness of vendor-specific strategies.

Vulnerabilities List Widget

Q: What does the Vulnerabilities List widget provide?
A: It gives a ranked view of the vulnerabilities present in your environment, prioritized by their Max Exposure Score.

Q: How is the Max Exposure Score determined?
A: It reflects the highest level of risk exposure associated with each vulnerability across all affected assets, incorporating severity, exploitability, reachability, and business context.

Q: Why does the ranking not always correspond to the highest CVSS scores?
A: Balbix includes real-time exposure conditions and asset criticality, going beyond static scoring.

Q: What functionality does the widget provide?
A: It is sortable, searchable, and highlights vulnerabilities with the highest scores at the top to help prioritize remediation efforts.

Exports

Q: Where can I find export options?
A: You can find these options in the Exports menu.

Q: What can I do in the Exports view?
A: Access previously generated files and filter export records by selecting a Date Range. You can also locate and select specific exports using the Checkbox Selector, and download selected export files using the Download button.

Alerts

Q: What does the Configured Sensors count show?
A: It shows the number of configured sensors.

Q: What is the difference between Raw Assets and Analyzed Assets?
A: Raw Assets are the number of assets ingested before deduplication, while Analyzed Assets are the number after deduplication.

Q: What does the Categorized Assets table display?
A: It displays assets with sufficient data fidelity for accurate categorization.

Q: What are Assets with Poor Visibility?
A: Assets with insufficient data fidelity for accurate categorization, excluded from dashboards and risk calculations.

Q: What are Recently Retired Assets?
A: Assets retired within the last 7 days due to lack of observations, excluded from dashboards and risk calculations.

Q: How does BX5 enrich asset details?
A: By enhancing asset records with contextual information such as business impact, exposure level, and operational relevance for accurate risk prioritization.

Q: How does BX5 handle asset categorization?
A: It categorizes assets into on-premise and cloud types using predefined classification logic.

Q: What are Unverified Assets in BX5?
A: Assets lacking sufficient data for proper categorization, requiring customer verification or data augmentation.

Q: What is the outcome of BX5's asset processing?
A: It ensures clarity in asset fidelity, helping prioritize security initiatives and allocate resources efficiently.

Logs

Q: How do I access logs in the system?
A: Click Logs in the left navigation menu. Use the From and To date/time fields at the top to filter logs.

Q: What information do the log table columns show?
A: The columns include Event Info, Type, Time, and Actor, showing what occurred, when, and who initiated it.

Q: How can I search for specific events in the logs?
A: Use the search bar in the upper-right corner to locate specific events by keyword. The table updates automatically after changes.

Configure asset and apps automations

Q: What is the scope of automation in Configure Asset and Apps Automations?
A: It can be current table filter, new filter, assets in specified group, or assets matching saved filter.

Q: What are the automation trigger types?
A: Upon next evaluation, based on a schedule, or on a specific date.

Q: What actions can be triggered with automation?
A: Send Slack, send email, add tags, send export, remove tags, set element attributes.

Q: What can you configure if you select Set Element Attributes?
A: Attribute to update, select asset type, select asset subtype.

Q: How do you activate the automation immediately?
A: Select "Make this active on creation".

Create user-defined groups and assign owners

Q: How do I create a user-defined group?
A: Use the workflow to create a new user-defined group.

Q: How can I assign an owner to a user-defined group?
A: Follow the steps in the workflow to assign an owner to the group.

Configure asset and apps dashboards

Q: What does the Asset List widget display?
A: It displays all discovered assets along with their potential breach impact in monetary terms, each asset’s hostname, and associated risk value to quickly identify assets with the highest potential cost if compromised.

Q: What information does the Assets by Site widget provide?
A: It shows each site alongside the total number of assets located there, helping to identify where the largest asset footprints lie for focused security and remediation efforts.

Q: What is the purpose of the Asset Coverage widget?
A: It compares the number of assets identified by different data sources to spot potential coverage gaps and ensure a comprehensive view of all assets.

Q: How does the Software Inventory widget assist users?
A: It displays the top installed software packages sorted by the total number of instances in the environment to track patch levels and potential vulnerabilities effectively.

Q: What does the Data Source Telemetry widget show?
A: It displays the top data sources contributing telemetry and the number of devices or assets each source covers to ensure comprehensive coverage and spot potential gaps.

Q: What information is provided by the Asset Types widget?
A: It shows a breakdown of assets by category, such as desktops/laptops, servers, IoT devices, etc., alongside their respective counts to understand the composition of the environment.

Set owners for predefined groups