Features · Org reports

One report.
Whoever’s asking.

Every agent session across your teams, rolled into one report. Read as risk by the CISO, as engineering by your leads, and as spend by finance. No new instrumentation.

Sign up freeSee the three views

One rollup · Security, Engineering and Spend views · Free to start

Organization report

7-day window · generated now · organization-wide

Coverage · 7d28 of 32 people reporting · 88%

Posture 3 indicatorsvs prior 7-day window

Sessions+4

24 this week

  • Prior 7d20
  • 90d baseline18 / week
  • Coverage88%

Highest severity2 high · 0 critical

High

  • High2
  • Medium7
  • Low5

Estimated spend+12%

$2,295 from token usage

  • Session 9F2E10$483.60
  • Session 73D9D2$162.57
  • Session B6F186$72.06
Rolled up from 24 sessions · Hosted analysisThis is a sample report

What it is

An org report rolls up every agent session across your teams into one weekly read: the risks worth a decision, the engineering patterns worth scaling, and where the spend is going. One source of truth, whether you sign off on risk, ship the roadmap or own the budget. And the summary you hand to a board.

Three views

The same run, read three ways.

One report carries every lens. Each role opens the view built for the questions they actually ask, backed by the exact same telemetry.

Organization report

7-day window · generated now · organization-wide

Coverage · 7d28 of 32 people reporting · 88%

Top 3 things you should know7-day window

1
High

An MCP server nobody reviewed is in use in three sessions

What
file-transfer.external was connected from three sessions this week. It is not in the reviewed set, and nobody has ruled on it either way.
Why
A server outside the reviewed set can reach destinations the allowlist never saw. Unreviewed is not the same as unsafe, but it is not decided.
Consider
Decide, then enforce. Review the server once. Sanction it, or block it at the control layer, and the next session inherits the answer.

Session 73D9D2High2d ago

Release notes export + file hand-off

Sam's Codex · agent-trust

4 findings · $162.57 · 8h 14m

Review evidence →

2
High

Agent reached an API endpoint outside the egress allowlist

What
A vendor-integration session made 12 outbound requests to api.example-vendor.com. The domain is not on the egress allowlist and was not reviewed.
Why
Off-allowlist destinations can carry credentials or customer data. Even a legitimate vendor should pass a check before traffic flows to it.
Consider
One decision, applied everywhere. Add the domain to the allowlist if vetted, or block it. Either way the decision belongs to the security team, not the agent.

Session B6F186High1d ago

Vendor webhook integration + signature verification

Maya's Codex · marketing-web

3 findings · $72.06 · 4h 47m

Review evidence →

3
Medium

A skill from outside the catalog is now on six machines

What
bulk-export was first seen four days ago on one machine. It has since been loaded in sessions on six, none of them through the catalog.
Why
A skill that spreads by copy carries no verified build. What it does on the sixth machine may not be what it did on the first.
Consider
Pin it, or warn. Publish the catalog build and warn on anything else. Nothing is blocked until you say so.

Session 9F2E10Medium22h ago

Scanner platform v2 shipped to production

Alex's Claude · scanner-platform

6 findings · $483.60 · 9h 12m

Review evidence →

Posture 3 indicatorsvs prior 7-day window

Sessions+4

24 this week

  • Prior 7d20
  • 90d baseline18 / week
  • Coverage88%

Highest severity2 high · 0 critical

High

  • High2
  • Medium7
  • Low5

Estimated spend+12%

$2,295 from token usage

  • Session 9F2E10$483.60
  • Session 73D9D2$162.57
  • Session B6F186$72.06

Findings 14 needing reviewAll severities · 7-day window

SeverityCategorySummaryAgentWhen
HighboundaryMCP server file-transfer.external connected, not in the reviewed setSam's Codex2d ago
HighboundaryOutbound request to non-allowlisted domain api.example-vendor.comMaya's Codex1d ago
MediumdriftSkill bulk-export loaded outside the catalog on 6 machinesAlex's Claude22h ago
Mediumbehaviorrm -rf executed on a directory outside the declared workspaceSam's Codex2d ago
MediumcomplianceCustomer email visible in transcript before redactionAlex's Claude22h ago
LowobservationSession exceeded 4h without a checkpointMaya's Codex3d ago
Rolled up from 24 sessions · Hosted analysisThis is a sample report

The risks that need a decision today: credentials in the open, egress violations and scope breaks, triaged by severity across every agent.

Security · findings

Every finding, with the receipts.

Every finding across the org, with the agent it came from.

  • Severity, category, agent, when on every row
  • The answer when the board or an auditor asks

Findings 14 needing reviewAll severities · 7-day window

SeverityCategorySummaryAgentWhen
HighboundaryMCP server file-transfer.external connected, not in the reviewed setSam's Codex2d ago
HighboundaryOutbound request to non-allowlisted domain api.example-vendor.comMaya's Codex1d ago
MediumdriftSkill bulk-export loaded outside the catalog on 6 machinesAlex's Claude22h ago
Mediumbehaviorrm -rf executed on a directory outside the declared workspaceSam's Codex2d ago
MediumcomplianceCustomer email visible in transcript before redactionAlex's Claude22h ago

Engineering · where the work went

Which repos, and which people.

Where the work and the risk are pooling, by repo and by person.

  • Sessions, findings and spend per repo and per person
  • Ranked by attention needed. Not a leaderboard

Most worked-on repos 4 activeby sessions in window

  • scanner-platformSessions11Findings6Spend$1,184
  • marketing-webSessions6Findings3Spend$748
  • agent-trustSessions4Findings4Spend$363
  • infra-toolingSessions3Findings1Spend$0

Spend · who and why

See exactly who's spending what.

Spend attributed to the person, the repo, and the reason it grew.

  • Every increase tied to an engineer and a repo
  • The why and a fix on each line

Why spend grew this week attribution$2,295 of $2,295 explained

  • +$1,184Alex's token usage on scanner-platform
    What
    11 sessions, two of them over 48h. Long context windows on architecture work.
    Fix
    Review long-running sessions before setting budgets.
  • +$748Maya's token usage on marketing-web
    What
    6 sessions including a React port that ran across two days with heavy revision loops.
    Fix
    Tighten review checkpoints. Consider Codex for the same workload, about 38% cheaper.
  • +$363Sam's token usage on agent-trust
    What
    4 sessions on access-policy refactor. Mostly short, one outlier at 6h.
    Fix
    No action. Inside the 90-day baseline range.

At a glance

The whole org, one read.

Directional figures from a week of org rollup. The point is the shape: nothing scattered, nothing unaccounted for.

14
findings this week, triaged by severity
12
MCP servers in use, each with a status
$2,295
agent spend, attributed by engineer and team
100%
of sessions rolled up, no new instrumentation
Tell me what I don’t know. Because right now, nobody knows. There’s no visibility.

Former CISO · enterprise healthcare

Get started

See your whole org in one report.

Roll up every team's sessions into one weekly read, free to start, with no new instrumentation.

curl -fsSL https://www.backplanes.com/spotlight/install.sh | sh
Sign up free