#1075 Adding more signals to risk score calculations Pull request opened by javuto Summary Device risk scoring lacked direct evidence for several endpoint security controls relevant to SOC 2 and ISO 27001. Add 13 checks covering Secure Boot, firewalls, Gatekeeper, SIP, screen lock, antivirus, automatic updates, UAC, reversible password storage, Linux mandatory access controls, ASLR, and audit service availability. • Add platform-specific daily snapshot queries and control mappings. • Treat missing or unsupported evidence as warnings. • Evaluate full snapshots so findings beyond the 100-row summary are included. • Prevent incomplete evidence from producing a pass while preserving confirmed failures. • Preserve administrator settings and existing scoring weights. These checks provide technical risk evidence; they do not establish compliance or certification. Rollout Upgrade posture-enabled API and TLS services, then apply the updated profiles to environment schedules. Existing schedules are not modified automatically. Windows Security Center checks are limited to Windows laptops because the API does not support Windows Server. Validation •

go test ./pkg/posture

•

go test ./cmd/api/handlers ./cmd/tls/handlers ./cmd/cli

• Validated query SQL and platform support against the bundled osquery schema. • Added regression coverage for evidence quality, score escalation, full snapshots, administrator overrides, and consistent device/fleet summaries. jmpsec/osctrl