Security posture¶
Security posture is the portfolio view: every application the console knows about, its authorization state, and the risk it carries, sorted worst first.
The tiles¶
| Tile | What it counts |
|---|---|
| Authorized | The posture the program carries today. |
| Proposed for acceptance | Review merge requests open; a reviewer's decision is pending. |
| With engineering | Hard gate failures being remediated. These cannot be proposed. |
| In pipeline | Scanned, not yet proposed for acceptance. |
Choose a tile to filter the list. All shows every application sorted by open risk.
States¶
| State | Meaning |
|---|---|
| Authorized | The review merge request was approved and merged. |
| Conditionally authorized | Authorized with accepted soft findings on record. |
| Pending authorization | Submitted; a decision is pending. |
| Blocked, hard gate failure | Cannot be submitted until engineering fixes it. |
| In pipeline, not yet submitted | Scan results exist; no merge request is open. |
Each row carries the container, its version and pipeline, its state, who decided and when, and a one line read of what the verdict rests on: which gates failed, which soft findings were accepted, and what is quiet.
Reading open risk¶
The list is sorted by open risk, worst first. Open risk combines what a reviewer has accepted and what is still waiting: accepted soft findings, pending High and Critical mitigations, and the age of the vulnerability database at scan time. The container at the top of the list is the one to ask about first.
Latest build¶
A row marked latest build is one whose most recent scan is newer than its authorization. The authorization stands for the run it was made on; the newer run has not been reviewed. This is how a regression surfaces: a container that was authorized and whose newest build runs as root, or carries a CVE the last review did not see.
Coverage gaps¶
A member of a system boundary with no scan record is surfaced as a gap. Gaps do not affect any verdict; they show what has not been measured.
Search¶
The search field filters by container name. Useful when the question is about one system, not the portfolio.