Skip to main content
The Playbook Insights view is a dedicated analytics dashboard within My Playbooks that gives you a bird’s-eye view of your playbook portfolio. It surfaces risk signals, coverage gaps, distribution metrics, and engagement stats so you can quickly understand the health and maturity of your playbooks at a glance. To access Playbook Insights, navigate to My Playbooks and select the Playbook Insights tab.

​
Filters

At the top of the page you will find a Saved Filters selector and a Filters button. These work the same way as in other playbook views — they let you scope all the data on the page down to a specific subset of playbooks (e.g. by label, stage, source, or incident type). Any filter you apply affects all widgets on the page simultaneously.

​
My Playbooks Distribution

This summary widget shows the total number of playbooks in scope and breaks them down into two categories:
  • Owned By Me Playbooks: The count and percentage of playbooks you own.
  • Shared With Me Playbooks: The count and percentage of playbooks others have shared with you.
Each category is clickable and takes you directly to the corresponding filtered view (Owned by me or Shared with me).
Insights Top Level

​
Risk Signals

The Risk Signals section highlights operational gaps and governance issues across your playbooks. Each signal shows a count of affected playbooks and an action button so you can address it immediately. You can sort the signals using the Sort by dropdown (default: Critical First). The available signals are:
  • Playbooks with no assigned responsible person: Playbooks that are missing a RACI-assigned responsible owner. Click Take an action now to bulk-assign one.
  • Playbooks with no assigned accountable person: Playbooks without an accountable stakeholder. Click Take an action now to address this.
  • Playbooks not tested the last 6 months: Playbooks that have not been exercised or validated recently. Click Review to go through them.
  • Orphaned playbooks: Playbooks that are not linked to any asset, framework tag, or incident type.
  • Playbooks that include removed or retired assets: Playbooks still referencing assets that have been deleted or retired from the platform.
  • Playbooks without mappings: Playbooks that have no framework or incident type mappings.
  • Playbooks not updated the last 6 months: Playbooks that may be stale and need a review.
  • Overly complex playbooks (30+ steps): Playbooks that exceed 30 steps and may benefit from being split into smaller, more focused procedures.
Use the Show Less / Show More toggle to collapse or expand the full list of signals.

​
Top Framework Tags

This panel lists the most-used framework technique tags across your playbooks. You can filter by framework using the dropdown (e.g. MITRE ATT&CK Matrix for Enterprise) and sort the results with the Sort by dropdown (default: Most Used). The table shows two columns:
  • Tag: The technique identifier and name (e.g. T1046 - Network Service Discovery). Each tag is a clickable chip that filters the playbook list.
  • Linked Playbooks: The number of playbooks associated with that tag.
You can page through the results using the pagination arrows at the bottom of the panel.

​
Framework Mapping Overview

This panel sits alongside Top Framework Tags and gives a per-framework summary of your mapping coverage. It shows:
  • Framework: The name of the framework (e.g. MITRE ATT&CK Matrix for Enterprise).
  • Linked Playbooks: How many playbooks are mapped to that framework.
Below the table, three counters show the breakdown:
  • Mapped Playbooks: Playbooks that have at least one framework tag.
  • Unmapped Playbooks: Playbooks with no framework mapping at all.
  • Multimapped Playbooks: Playbooks mapped to more than one framework.
Use the pagination arrows to move between frameworks.

​
Incident Type Distribution

This bar chart shows how your playbooks are distributed across incident types (e.g. Phishing, Data exfiltration, Social engineering, Spoofing). Use the Sort by dropdown to change the ordering of the bars. Hovering over each bar reveals the exact playbook count for that incident type. Pagination arrows allow you to browse incident types if there are more than can fit on one page.

​
Insights (Quick Stats)

Below the distribution charts, four highlight cards surface the most important single-value metrics from your current playbook set:
  • Top Incident Type: The incident type with the most linked playbooks, along with the count of linked playbooks.
  • Main Source: The source (e.g. Cymph) that contributes the largest number of playbooks to your library.
  • Most Targeted Asset: The asset referenced most frequently across your playbooks, along with the number of playbooks that reference it.
  • Most Viewed Playbook: The individual playbook that has been opened the most times, along with the total open count.

​
Labels

The Labels widget renders a word cloud of all labels assigned to playbooks in the current view. Labels that appear more frequently are displayed in a larger font. This gives you a quick visual summary of the most common themes, tactics, and categories across your playbook library.

​
Playbook Source Origin

This donut chart shows the percentage breakdown of your playbooks by source origin (e.g. Cymph, imported from a SOAR, etc.). Hovering over each segment reveals the source name and its percentage.

​
Automation Degree

This bar chart shows how many playbooks fall into each automation bracket:
  • 0%: No automation
  • 1–25%: Low automation
  • 26–50%: Moderate automation
  • 51–75%: High automation
  • 76–100%: Fully or near-fully automated
This helps you understand how much of your playbook portfolio can run without manual intervention and where investment in automation could be most impactful.

​
Stage Distribution

This horizontal stacked bar chart shows the proportion of playbooks in each lifecycle stage:
  • Live (green): The playbook is active and usable.
  • Draft (purple): The playbook is a work in progress.
  • Revoked (red): The playbook has been retired and is no longer in use.
The percentage for each stage is displayed directly on the bar.

​
Impact and Severity Distribution

Two horizontal bar charts show the distribution of your playbooks by their assigned Impact and Severity values. The scale for both ranges across: Not Specified, Low, Medium, High, and Critical. These fields are set on each individual playbook and help you understand the overall risk posture of your library.