SaaS Posture Report
Executive summary
High risk: 79 out of 100 (0 is best)
Three people who have left the company still have admin rights to every project, space and user. Two Confluence spaces, including network diagrams, are readable by anyone on the internet. Five Critical pentest findings have sat open for over 90 days. All of this is fixable in about a day, which would bring the score to 35.
Leavers can still administer everything
3 ex-staff admin accounts, plus admin rights given to all 380 Jira users. One leaked password would expose the whole estate.
Internal content is public
Network diagrams and firewall records in the INFRA space can be read without logging in.
Known vulnerabilities aren't being worked
5 Critical pentest findings past their deadline, visible to every licensed user, with no owner.
The overall score is the worst category, so one neglected area can't be averaged away. Any open Critical finding keeps the overall score at 50 or above.
Trend
Weekly scans, lower is better. This week: new: IT-04 (another automation rule now runs as a leaver). Resolved: two admin roles removed (PA-01, 13 → 11 admins); 12 inactive licences reclaimed (IA-03, 31 → 19).
Fix first
| # | Action | Rules | Effort | Suggested owner |
|---|---|---|---|---|
| 1 | Remove admin rights from the 3 leavers and from the jira-software-users group | PA-02 PA-04 | 25 min | Atlassian org admin |
| 2 | Turn off anonymous access on INFRA, ONBOARD and CUST | DX-01 | 30 min | Atlassian org admin |
| 3 | Lock down Security Assessments, rotate and remove credential pages, and triage the 5 open Criticals | DX-02 LG-04 | 3–4 hrs | Security lead |
| 4 | Move the 4 automation rules owned by leavers to a service actor | IT-04 | 20 min | Jira admin |
| 5 | Archive the 31 dormant spaces and 9 dormant projects | HY-01 | 2 hrs | Team leads |
Doing all five takes the score from 79 to about 35 and clears every Critical finding.
Findings (17 open)
DX-01Anonymous or public accessCritical25 / 25 pts
Evidence
- Confluence space INFRA (Infrastructure): anonymous View enabled. 214 pages, including network diagrams and firewall change records.
- Confluence space ONBOARD (New starter guide): anonymous View enabled. 38 pages.
- Jira project CUST (Customer requests): Browse projects granted to 'Anyone on the web'.
Why it matters
Anyone on the internet can read these, and search engines may already have indexed them. Network diagrams are a gift to an attacker planning a route in.
How to fix
- Confluence → Settings → Global permissions → Anonymous access: check whether it needs to be on at all.
- For INFRA and ONBOARD: Space settings → Permissions → Anonymous → remove View.
- For CUST: Project settings → Permissions → Browse projects → remove 'Anyone on the web'.
- If some content must be public, move just those pages to a dedicated public space.
How Lintel checks it's fixed
DX-01 passes when no space or project is readable without logging in, or each exception is documented.
DX-02Sensitive content in widely visible placesCritical20 / 25 pts
Evidence
- Jira project SECASSESS (Security Assessments): 22 pentest findings visible to all 380 licensed users.
- Confluence pages titled 'AWS credentials (old)', 'Router passwords', 'Service accounts' in space IT. Visible to all users.
- Content was matched by title and label only; Lintel did not read page bodies (content scanning is opt-in).
Why it matters
Detailed vulnerability write-ups and credential pages tell an attacker or a disgruntled insider exactly where to look.
How to fix
- SECASSESS: Project settings → Permissions → restrict Browse projects to a security group.
- For each credential page: confirm the secrets are rotated, then delete the page or move it to a restricted space.
- Move secrets into a password manager or vault.
How Lintel checks it's fixed
DX-02 passes when no Critical sensitive-content match is visible to all users.
LG-04Security findings open beyond deadlineCritical20 / 20 pts
Evidence
- SECASSESS-3, -7, -11, -14, -19: 5 Critical findings open for more than 90 days (oldest 214 days).
- None has an assignee or a due date.
Why it matters
Findings that sit in a tracker untouched give false assurance. Auditors and insurers treat open Criticals past their deadline as accepted risk you haven't documented.
How to fix
- Triage each Critical with its system owner: fixed, fix scheduled, or risk accepted.
- Close the fixed ones with evidence; give the rest an owner and a due date.
- Record any accepted risk formally, signed off by the security lead.
How Lintel checks it's fixed
LG-04 passes when no Critical finding is open for more than 30 days without an owner and date.
PA-02Admins who have left or are inactiveHigh20 / 20 pts
Evidence
- d.okafor@harbridge.co.uk: organisation admin. Deactivated in Entra ID on 3 Aug 2025; last Atlassian activity 11 Aug 2025.
- r.lindqvist@harbridge.co.uk: site admin. Last active 14 months ago; still holds a non-expiring API token (see IT-03).
- s.patel@harbridge.co.uk: Jira admin. Left the company in June 2026 per IdP; account still active in Atlassian.
Why it matters
An admin account nobody uses is an unwatched master key. If its password or token leaks, an attacker gets every project, space and user, and nobody will notice the sign-in.
How to fix
- Go to admin.atlassian.com → Directory → Users and open each account above.
- Remove the organisation and product admin roles.
- If the person has left, deactivate the account (this also blocks API tokens).
- Add a leaver step to your offboarding checklist: review Atlassian admin roles the same day.
How Lintel checks it's fixed
Re-run the scan: PA-02 passes when no admin is deactivated in the IdP or inactive for more than 90 days.
PA-04Admin rights granted to a broad groupHigh15 / 15 pts
Evidence
- Group jira-software-users (380 members) holds the Administer Jira global permission.
- Granted on 12 Mar 2021, probably during the original setup and never removed.
Why it matters
Everyone with a Jira licence can change workflows, permission schemes and project visibility, so a single phished account can open up every project.
How to fix
- Jira → Settings → System → Global permissions.
- Remove jira-software-users from Administer Jira.
- Grant it to a small, named group (e.g. jira-admins) instead.
How Lintel checks it's fixed
PA-04 passes when no default or all-user group holds an admin permission.
IT-04Automations owned by leaversHigh15 / 15 pts
Evidence
- 4 Jira automation rules run as deactivated users, including 'Auto-assign P1 incidents' (actor: s.patel).
Why it matters
When the owner's account is removed, these rules break silently, and in the meantime they act with a leaver's permissions.
How to fix
- Jira → Settings → System → Automation, then filter by rule actor.
- Change the actor to the Automation for Jira app user, or a named service account.
- Give each rule a current owner.
How Lintel checks it's fixed
IT-04 passes when no rule runs as a deactivated user.
PA-03Admins outside your identity providerHigh14 / 20 pts
Evidence
- tomas@fjordit.no: contractor, site admin, unmanaged external account.
- harbridge.it@gmail.com: org admin, shared mailbox, unmanaged account.
Why it matters
These accounts bypass your SSO and MFA policy, so you can't confirm how they're protected or switch them off when someone leaves.
How to fix
- Replace each with a named, managed account in your domain.
- Remove admin roles from the external accounts.
- Keep at most one documented break-glass account, with a hardware key.
How Lintel checks it's fixed
PA-03 passes when every admin is a managed account covered by SSO and MFA.
IT-03Long-lived personal API tokensHigh9 / 15 pts
Evidence
- 17 API tokens with no expiry date.
- 6 belong to users inactive for more than 90 days (incl. r.lindqvist).
Why it matters
Personal tokens bypass SSO and MFA and survive role changes.
How to fix
- admin.atlassian.com → Security → API tokens: revoke tokens for inactive users.
- Set a maximum token lifetime for managed accounts.
How Lintel checks it's fixed
IT-03 passes when no token is non-expiring.
LG-02Projects and spaces without an active ownerHigh8 / 15 pts
Evidence
- 25 of 110 projects and spaces (23%) have a lead or owner who has left.
Why it matters
With nobody accountable, access requests get rubber-stamped and nothing gets cleaned up.
How to fix
- Export the list (CSV in the full report).
- Assign a current owner or archive the container.
How Lintel checks it's fixed
LG-02 passes at 95% or more owned by an active user.
IA-03Inactive accounts still licensedHigh8 / 20 pts
Evidence
- 19 of 380 licensed users (5%) inactive for more than 90 days.
- That's about £2,600 a year in unused Jira and Confluence licences.
Why it matters
Dormant accounts are leavers your offboarding missed. They also cost money.
How to fix
- admin.atlassian.com → Directory → Users → filter by last active.
- Remove product access, or deactivate the account.
How Lintel checks it's fixed
IA-03 passes below 2% of licensed users.
PA-01Too many administratorsHigh6 / 15 pts
Evidence
- 11 admins across org, site and product roles for 420 people.
- Healthy for your size: 8 or fewer.
Why it matters
Every admin is another route to the whole tenant, and another account to protect.
How to fix
- Review the admin list with your security lead.
- Remove admin roles from anyone who doesn't need them weekly.
How Lintel checks it's fixed
PA-01 passes at 8 or fewer admins.
HY-01Dormant projects and spaces not archivedMedium20 / 20 pts
Evidence
- 31 of 72 Confluence spaces with no edits in 12 months.
- 9 of 38 Jira projects with no activity in 12 months.
- Together they hold 6,140 pages and 11,800 work items, all still searchable and permissioned.
Why it matters
Dormant containers keep their old permissions and data. They make the area that can be exposed bigger, and every other review slower.
How to fix
- Confirm with the listed owner (or their manager) that each is finished.
- Confluence: Space settings → Archive space. Archived spaces drop out of search but can be restored.
- Jira: archive the project (Premium) or move it to a read-only permission scheme.
How Lintel checks it's fixed
HY-01 passes when fewer than 5% of containers are dormant for over 180 days.
HY-03Content last maintained by leaversMedium15 / 15 pts
Evidence
- 32 of 72 spaces (44%) were last edited by someone who has left.
Why it matters
Documentation nobody owns goes quietly wrong, and people follow out-of-date runbooks.
How to fix
- Archive the ones covered by HY-01.
- For the rest, assign an owner and a review date.
How Lintel checks it's fixed
HY-03 passes below 10% of containers.
IA-04Guest and external users unreviewedMedium10 / 10 pts
Evidence
- 41 users on unverified domains (contractors, agencies). None reviewed in the last 90 days.
Why it matters
External accounts outlive the contracts that justified them.
How to fix
- Send each sponsor a list to confirm or remove.
- Set a 90-day review reminder.
How Lintel checks it's fixed
IA-04 passes when all guests are reviewed within 90 days.
IT-02Apps on deprecated frameworksMedium6 / 10 pts
Evidence
- 2 of 14 installed apps still run on Connect. Support ends 31 Jan 2027.
Why it matters
Apps that stop getting updates stop getting security fixes.
How to fix
- Check each vendor's Forge migration plan.
- Replace or remove apps with no plan.
How Lintel checks it's fixed
IT-02 passes when every app is on a supported framework.
HY-02Stale open workLow8 / 15 pts
Evidence
- 1,420 of 5,460 open work items (26%) untouched for more than a year.
Why it matters
A backlog nobody touches hides the work that matters and slows every search.
How to fix
- Bulk-close with a 'Won't do – stale' resolution and a label, so the change can be reversed.
- JQL: statusCategory != Done AND updated <= -365d
How Lintel checks it's fixed
HY-02 passes below 10%.
IA-06Shared or generic accountsLow5 / 5 pts
Evidence
- 3 generic accounts with interactive access: jira-admin, svc-test, training.
Why it matters
Actions by shared accounts can't be traced to a person.
How to fix
- Replace with named accounts, or convert to service accounts without interactive sign-in.
How Lintel checks it's fixed
IA-06 passes at 0.
Passed and not assessed (13)
| Rule | Check | Result | Detail |
|---|---|---|---|
DX-03 | Over-broad default visibility | Pass | New projects use a scheme limited to project roles. |
DX-04 | Externally shared containers | Pass | No JSM portals open to public sign-up. No Confluence public links. |
LG-03 | Headroom on platform hard limits | Pass | Highest usage: 61 statuses in one workflow (limit 200). |
HY-04 | Test or sandbox containers | Pass | 1 sandbox project, under 90 days old. |
HY-05 | Duplicate or overlapping containers | Pass | No near-duplicate names found. |
HY-06 | Naming and categorisation drift | Pass | 94% of projects follow the naming convention. |
HY-07 | Containers with no landing page | Pass | All spaces have a homepage. |
IT-01 | Third-party apps with broad scopes | Pass | All 14 apps have a named owner and were reviewed in the last 12 months. |
IT-05 | Webhooks to insecure endpoints | Pass | 3 webhooks, all HTTPS to known hosts. |
IA-02 | MFA enforced | Pass | Enforced through Entra ID for all managed accounts. |
IA-05 | Open self-signup or unverified domains | Pass | harbridge.co.uk verified; product access by invitation only. |
LG-01 | Audit log retained and exported | Not assessed | Needs Atlassian Guard to read the organisation audit log. Not counted in the score. |
IA-01 | SSO enforced for managed users | Not assessed | Needs Atlassian Guard to read authentication policies. Not counted in the score. |
Not assessed means the scan couldn't check the rule with the access it had. It's never counted as a pass. Adding Atlassian Guard, or an org admin API key, lets Lintel check these.
Where this report goes
Lintel runs on a schedule (weekly here, Mondays at 06:00) from a machine you control, keeps the history for the trend above, and posts a summary to your team channel.
3 Critical · 1 new · 2 resolved
Top fix: remove admin rights from 3 leavers (PA-02)
Open report
Risk score 79 / 100 (last week 81)
Critical 3 · High 8 · New 1 · Resolved 2
View findings
About this scan
| Collector | lintel-scan 0.1, run by a scheduled task on HF-OPS-01 as svc-lintel |
| Access used | Read-only. Org admin API key (read scopes) and a Jira/Confluence read-only service account |
| Coverage | 38 Jira projects, 72 Confluence spaces, 1 JSM portal, 420 users, 14 apps, 61 automation rules |
| Duration | 6 min 12 s · 1,904 API calls |
| Scoring | Each rule scores 0 at its healthy threshold and its full points at its neglected threshold. A category's score is its share of the points available. The overall score is the worst category, with a floor of 50 while any Critical is open. |