Skip to main content

Organization Security Posture: Know Your Risk Score Before Something Goes Wrong

· 8 min read
VolatiCloud Team
VolatiCloud Team
VolatiCloud

Most trading teams discover a security gap the hard way — an API key leaks, a stale team member still has access, or an account has no recovery path when the person who set it up leaves. VolatiCloud's new Organization Security Posture hub changes that: it computes a real-time risk verdict for your organization and tells you exactly what to fix, before anything breaks.

What Is the Security Posture Hub?​

The Security Posture Hub is a single page inside your VolatiCloud organization — at Organization → Security — that aggregates every security signal across your account into one verdict:

VerdictMeaning
GOODAll critical signals are healthy. Encryption is set up, recovery codes exist, and no stale access is detected.
NEEDS ATTENTIONOne or more signals are suboptimal. Risk is real but not immediate — fix these before they compound.
AT RISKA critical gap exists. Your organization is in a single-point-of-failure state: encrypted resources exist but no recovery path does, or someone who can decrypt your credentials left the team.

The verdict is computed server-side on every relevant change — not cached, not polled on a schedule. When you issue a new recovery code, the posture updates in the same response.

The Scorecard: Four Signals at a Glance​

Below the verdict banner, a four-chip scorecard summarizes the individual dimensions:

Encryption enrollment tracks whether you (or your team members) have set up an organization passphrase. Without it, your exchange API keys and strategy configs are encrypted at the server level but not under your own key — a meaningful difference. See how the org passphrase works for the full story.

Recovery codes are the safety net for passphrase-based encryption. If you set a passphrase and then lose it, recovery codes are your only path back to your credentials. Zero recovery codes with a passphrase set is the most common AT_RISK condition we see.

People who can unlock (admin-tier view only) counts how many team members are enrolled and have active recovery access. An organization where only one person can decrypt anything is operationally fragile — if that person leaves or loses their device, the org's encrypted resources are stranded.

API key posture reflects whether your connected exchange API keys follow the withdrawal-disabled rule and other key hygiene signals.

Guided Wizards: From Score to Fix in One Click​

Knowing your posture is only half the value. The hub's recommended action CTA and guided wizards close the gap without dropping you into a settings maze.

When the hub surfaces a recommended action — say, "Add a recovery code" or "Revoke stale team access" — clicking it opens a step-by-step wizard inline. The wizard walks through the exact sequence: generate a recovery code pair, download the sheet, confirm storage, done. No hunting through menus, no half-finished flows.

The two main wizards today:

Add Recovery Wizard — guides you through generating passphrase recovery codes and safely storing them. It enforces the confirmation step (you must confirm you've saved the codes before the wizard closes) so you can't accidentally dismiss it with an empty recovery set.

Give Access / Revoke Stale Wizard — for org admins, shows current team enrollment status and flags members whose passphrase enrollment is stale or who've had their passphrase revoked but still appear in the access list. One click to clean up.

Member view vs admin view

If you're a regular org member without the manage-encryption scope, the Security hub shows a simplified view focused on your own enrollment state — whether your own passphrase is set and whether you have recovery codes. The org-wide "people who can unlock" metric and the recommended action CTAs for team access are visible only to admins.

Proactive Alerts When Posture Worsens​

The hub showing your current state is useful. Being alerted the moment your state degrades is better.

VolatiCloud's alerting system now includes a Security Posture Changed alert. This is a transition-driven event: it fires when your organization's posture verdict worsens — GOOD to NEEDS_ATTENTION, or either to AT_RISK. It does not fire on every page load, and it does not fire when posture improves (there's no noise from routine upgrades to your score).

The four actions that can trigger a posture transition and alert:

  1. Setting an organization passphrase (changes the encryption signal)
  2. Issuing a passphrase enrollment token to a team member
  3. Redeeming an enrollment token
  4. Revoking a team member's passphrase

When any of these causes the verdict to worsen, a Critical-severity security alert goes to your configured email addresses within seconds. The email doesn't contain any cryptographic details — just the new verdict and a direct link back to the Security hub so you can act.

This integrates with the same alerting pipeline that handles trade events and billing alerts. If you've already configured alert recipients under Alerts → Alert Rules, security posture alerts follow the same delivery rules. See how the alert system works and the alert rules reference for configuration details.

The AT_RISK Banner: Always Visible​

If your organization's posture reaches AT_RISK, a red banner appears across the entire VolatiCloud console — not just on the Security page. Every page load shows the banner until the underlying issue is resolved. The sidebar navigation also gains a red dot on the Security menu item so the signal doesn't get lost even when the banner scrolls out of view.

This design is intentional. An AT_RISK organization has a critical, potentially time-sensitive gap. A banner that only shows on the Security page is too easy to ignore. The app-wide banner keeps the issue visible until it's fixed — then it disappears automatically when the posture recomputes to a better state.

Why This Matters for Algorithmic Traders​

Crypto trading teams often set up security configurations once and forget them. A co-founder leaves; their encryption enrollment stays. A passphrase is set without adding recovery codes because "we'll do it later." A team member sets up the org's exchange connections under their personal passphrase with no recovery path.

None of these feel urgent until they are. The Security Posture hub turns "we should check on that" from a vague intention into a concrete, measured score that surfaces proactively.

The hierarchy of signals the posture tracks maps directly to real failure modes:

  • No passphrase set → API keys and strategy configs sit under server-only encryption. VolatiCloud's field-level AES-256-GCM encryption still protects them, but your organization doesn't control the decryption path. Passkey-encrypted strategies take this further.
  • Passphrase set, no recovery codes → Single point of failure. Lose the passphrase, lose access to encrypted resources permanently.
  • Only one person can unlock → Operational fragility. An AT_RISK flag the system will surface automatically.

How to Check and Improve Your Posture​

  1. Go to console.volaticloud.com, open your organization, and navigate to Organization → Security.
  2. Read your verdict. If it's GOOD, you're done. If not, the recommended action CTA shows you the highest-priority fix.
  3. Click the CTA to open the guided wizard. Follow the steps — each wizard is designed to be completable in under two minutes.
  4. Return to the hub after each fix. The posture recomputes immediately.

If you manage multiple organizations, each has its own independent posture. Switch between orgs from the top navigation and check each one.

Recovery codes are one-time

Recovery codes generated by the Add Recovery Wizard are shown once and cannot be retrieved again from the platform. Download and store the recovery sheet somewhere durable — a password manager, an offline safe, or a printed copy in a secure location. The wizard enforces a confirmation step for exactly this reason.

Your security posture score is live in your organization now. Head to Organization → Security in console.volaticloud.com to see your verdict and close any open gaps — the guided wizards get you to GOOD in minutes, not hours.