In environments with many devices, changes to policy classifications can increase threat detections across your fleet, triggering issues in the MES console that you must track and resolve. Even small changes like changing a risk level from low to medium can cause unintended consequences.

Impact Assessment for advanced and premium customers calculates in advance the number of groups and devices in your fleet that will be impacted by a change to a policy classification.

• Increasing a risk level for a policy violation, such as going from medium to high, triggers more threats in your fleet.

• Decreasing a risk level for a policy violation, such as going from medium to low, lowers the risk status for existing issues and does not trigger more threats in your fleet.

  Impact assessments apply to changes to policy risk levels, responses, escalations, and settings options.

How the Impact Assessment Feature Works

Changing one or more policies on the Protections module Policies tab posts a Review and Save button that triggers the impact assessment process. Lookout returns a list with a row for each policy, including the policy name, device groups and devices affected. You can delete any particular policy from that list while still continuing with the rest of the changes.

Calculating the assessment might take longer than a minute if the system is busy. Policy changes may take up to 24 hours to complete.

Changes to multiple policies returns a list with a row for each policy. Including the policy name, device groups and devices affected. You can delete any particular policy from that list while still continuing with the rest of the changes.

Multi tenancy support is limited to listing the tenants affected and the number of devices in each affected tenant. It does not assess each device or group individually.

To use this feature: