Analytics

The analytics section turns operational data — issuances, renewals, expiries, failures — into forecasts and prioritized recommendations. It answers three questions at a glance: what will break, when, and what should you do about it first?

​

What it is

The predictive dashboard computes risk scores for every certificate, surfaces renewal recommendations ordered by urgency and blast radius, flags anomalies in issuance patterns, and produces an expiry timeline so you can see the next 90 days of certificate activity at a glance.

​

When to use it

• Start your shift by checking the risk heatmap for any critical/urgent items that surfaced overnight.
• Schedule renewals for a batch of high-risk certificates before their expiry window opens.
• Acknowledge a false-positive anomaly so it stops appearing in the feed.
• Use capacity forecasts to plan CA scaling before a growth spike hits.

​

Set it up

No setup is required — analytics are computed automatically from your certificate inventory. For the most accurate results, run a discovery scan before relying on the dashboard for the first time, since certificates not yet in inventory are not scored.

​

What you’ll see

Analytics renders four panels:

• Expiry timeline — bar chart of certificate expiries per day for the next 90 days. Click any bar to see which certificates expire on that day.
• Renewal queue — top 20 renewal recommendations ordered by priority and blast radius. Each recommendation shows the recommended renewal date and the reasoning (for example, “RSA-2048, expires in 18 days, deployed to 6 endpoints”).
• Anomaly feed — unacknowledged anomalies with inline acknowledge and false-positive buttons.
• Risk heatmap — certificates plotted by days-to-expiry and blast radius so critical/urgent items stand out.

​

Risk model

Each certificate receives a periodic risk score based on:

• Days until expiry (weighted heavily below 30 days)
• Weak cryptography (MD5, SHA1, RSA below 2048 bits)
• Excessive validity (above 397 days per CA/B baseline)
• Deployment blast radius (how many endpoints and services)
• Historical renewal failure rate
• Non-standard SAN patterns

Click Recalculate on any certificate to force an on-demand score update.

​

Renewal recommendations

Each recommendation carries a priority (low, medium, high), a recommended renewal date, a risk score, human-readable reasoning, and an automationEligible flag. You can schedule a recommended renewal directly from the analytics panel.

​

Anomaly detection

Anomalies are flagged automatically and appear in the Anomaly feed: Acknowledge an anomaly with False positive to suppress similar patterns in the future. The API surface for analytics and recommendations is documented at API Reference.

​

Related