Executive IT Command Center · Tareq Abbassi

92/100

IT Health Score

▲ +4 vs last period

96.2%

SLA Attainment

▲ +1.8 pts

4.6/5

CSAT (30-day)

▲ +0.2

14

Critical Vulnerabilities

▼ -9 this month

98.6%

EDR Coverage

— stable

$128k

Monthly Cloud Spend

▼ -6.4% (optimized)

Risk & Service Trend open critical+high vulns vs SLA attainment

IT Health Composition

92
Composite

Security posture · 90

Infrastructure · 94

Service delivery · 93

Asset hygiene · 89

Weighted composite of 22 signals

AI Executive Assessmentgenerated from live telemetry

Attention Required auto-prioritized

Item	Domain	Owner	Age	Priority
CVE-2026-30187 — Ivanti EPMM RCE on 3 mobile-mgmt servers	Vulnerability	Infra	2d	Critical
Ransomware behavior blocked — LAPTOP-4821, contained by EDR	EDR	Security	6h	Critical
SLA breach risk — 7 P2 tickets >80% of resolution window	ITSM	Service Desk	1d	High
Orphaned Azure resources — 41 unattached disks ($3.1k/mo)	Cloud	Infra	5d	Medium
SAN latency degradation — AUS storage array, NOC ack’d (PagerDuty)	Monitoring	NOC	18m	High
388 endpoints exit hardware warranty within 90 days	Assets	IT Ops	—	Medium

Ask the Command Centernatural-language queries across every connected system

›

7,902

Agents Deployed

98.6% of fleet

3

Active Threats (contained)

▼ from 11

1,284

Threats Blocked · 30d

auto-remediated 94%

112

Agents Outdated

rollout in progress

Detections by Day malware · PUA · behavioral · ransomware

Agent Coverage by Platform

Recent High-Severity Detections

Endpoint	Detection	Classification	Action	Status
LAPTOP-4821	Behavioral: mass file encryption attempt	Ransomware	Kill + quarantine + isolate	Contained
WKS-AUS-0233	Cobalt Strike beacon signature	C2	Kill + network isolate	Contained
MAC-VAN-1107	Unsigned kernel extension load	Suspicious	Blocked	Resolved
SRV-DC-04	Credential dumping attempt (LSASS)	CredTheft	Kill + alert SOC	Investigating

14

Critical Open

▼ -9 MoM

97

High Open

▼ -31 MoM

11.4d

Mean Time to Remediate (crit)

▼ 3.2 days faster

-27%

Backlog vs Q1

automation-driven

Backlog Burn-Down open vulns by severity · 6 months

Open by Severity

Top Open Vulnerabilities click a row → AI assessment

CVE	Affected	CVSS	Severity
CVE-2026-30187	Ivanti EPMM · 3 servers	9.8	Critical
CVE-2026-21412	Windows SmartScreen · 214 endpoints	8.1	High
CVE-2025-52799	Chrome (V8) · 1,893 endpoints	8.8	High
CVE-2026-0281	OpenSSL 3.2 · 47 servers	7.4	Medium
CVE-2025-48991	Adobe Acrobat · 622 endpoints	7.8	Medium

AI Vulnerability Assessmentcontextual risk · blast radius · action

AZ

Microsoft Azure

1,842 resources · 3 subscriptions · 2 regions

$74.2kmonthly spend

AWS

Amazon Web Services

1,204 resources · 4 accounts · 3 regions

$53.8kmonthly spend

Spend Trend & Optimization 6 months · combined

Cloud Hygiene Flags

Finding	Count	Est. Waste	Priority
Unattached managed disks (Azure)	41	$3.1k/mo	Medium
Idle EC2 instances <3% CPU 30d	17	$4.8k/mo	Medium
Public S3 buckets (non-static-site)	2	—	Critical
Untagged resources (no owner/cost-center)	203	—	Low
Snapshots >180 days	96	$1.2k/mo	Low

8,014

Total Managed Assets

endpoints + servers + mobile

96.8%

Inventory Accuracy (CMDB)

▲ reconciliation automated

388

Warranty Expiring ≤90d

refresh plan drafted

214

OS End-of-Support

▼ migration wave 3 of 4

Fleet Composition by type & OS

Hardware Age Distribution

Lifecycle Watchlist

Segment	Count	State	Plan
MacBook Pro 2021 fleet	1,240	Entering year 5 FY27	Phased refresh · budget submitted
Windows 10 holdouts	214	EOL	Win11 wave 3 in progress
Conference room systems	86	Mixed vendors	Standardization RFP
Lab / build servers	312	On-prem	Cloud-migration assessment

1,214

Hosts Monitored · 18.4k checks

Checkmk distributed

99.96%

Infra Availability (30d)

▲ target 99.9%

6

Active Alerts · 2 critical

both acknowledged

4m 12s

MTTA · PagerDuty

▼ 38s faster

38m

MTTR · P1/P2 (30d)

▼ from 51m

Incident Flow — PagerDuty weekly · triggered vs resolved · by urgency

Host States — Checkmk

Current Service Problems Checkmk · live board

Host	Service	State	Duration	Handled
SAN-AUS-01	Datastore latency > 25ms	CRIT	18m	Ack — NOC investigating
FW-VAN-02	HA sync degraded	CRIT	42m	Ack — vendor case open
SRV-BLD-07	CPU load 15-min > 90%	WARN	2h 10m	Build queue — expected
UPS-LV-01	Battery runtime < 12 min	WARN	6h	Replacement scheduled
ESX-AUS-11	Host unreachable (ping)	UNREACH	9m	Ack — remote hands dispatched

NOC On-Call — PagerDuty follow-the-sun rotation

Tier	On call now	Region	Until
Primary	NOC — R. Alvarez	AUS	08:00 CT
Secondary	NOC — D. Cho	VAN	08:00 CT
Escalation	Infra Lead — M. Okafor	AUS	Mon
Executive	Director, IT — T. Abbassi	—	standing

Escalation policy: 5m → secondary · 15m → lead Incidents this month: 31 · 0 SLA breaches

241

Open Tickets

▼ -12% WoW

96.2%

SLA Attainment (30d)

▲ +1.8 pts

3.4h

Median First Response

target 4h

4.6/5

CSAT · 1,182 surveys

▲ +0.2

31%

Auto-Resolved / Deflected

▲ AI + self-service

Ticket Volume & Deflection weekly · created vs auto-resolved

Open Ticket Aging

SLA Watch — At-Risk Tickets >80% of resolution window consumed

Ticket	Summary	Priority	Open
INC0048112	VPN auth failures — Vancouver office	P2	1d 21h
INC0048096	Shared drive permissions — Finance	P2	1d 14h
REQ0031877	Contractor onboarding — badge + accounts	P3	3d 2h
INC0048071	Conference AV failure — HQ boardroom	P3	2d 6h

CSAT Trend & Drivers

Top praise: speed of resolution Top friction: hardware turnaround

Phased Plan

Days
1–30

Listen & assess

Understand the environment before changing it. Earn the team's trust first.

▸1:1s with every member of the IT team — what works, what's broken, what they'd fix first.
▸Meet the business stakeholders — Security, People, Finance, Legal, Engineering — and ask how IT is failing them.
▸Baseline the numbers: ticket volume, SLA attainment, CSAT, open vulnerabilities, asset accuracy, spend.
▸Inventory the stack and the contracts — what we own, what we pay for, what overlaps.
▸Deliver a written current-state assessment to the President with a recommended 90-day plan.

Days
31–60

Stabilize & make it visible

Fix what's on fire, then put IT on a measured footing so leadership can see it.

▸Close the critical security gaps found in week one — patch, MFA coverage, offboarding hygiene.
▸Stand up SLAs and a reporting cadence — this dashboard, reviewed monthly with leadership.
▸Fix the top 3 employee pain points identified in the listening tour (usually onboarding, hardware, access).
▸Establish change management — a lightweight CAB so we stop breaking things accidentally.
▸Start the SaaS/vendor rationalization pass — find the overlap and the shelfware.

Days
61–90

Build & automate

Scale the function through systems, not headcount. Make IT quiet.

▸Ship automated onboarding/offboarding — HRIS → identity → access → device, hands-off.
▸Launch AI-assisted support — deflect the repetitive tickets so the team works on higher-value problems.
▸Publish the 12-month roadmap and budget — with the government-contract security requirements sequenced in.
▸Define the team's growth plan — who's ready for more, where we need to hire.
▸Report against the day-1 baseline. Show the delta.

Success Metrics baseline → 90-day target

SLA attainmentbaseline→95%+

CSATbaseline→4.5+

Critical vulnerabilitiesbaseline→zero >30d

Onboarding time-to-productivemanual→day one

Ticket deflection—→measured & rising

Tool spendbaseline→rationalized

Operating Principles

Make technology quiet. When IT is done right, nobody thinks about it — people open their laptop and do their best work. Automate before you hire. Headcount should go to hard problems, not repetitive ones. Measure everything, report honestly. Leadership can't support what it can't see — including the bad news. IT is a partner, not a gate. Security and speed aren't opposites if the controls are designed well. Build the team, not just the systems. The function outlives any one project.

Executive Summary