[{"data":1,"prerenderedAt":1686},["ShallowReactive",2],{"page-\u002Fdethereal\u002Freview-and-analysis":3,"navigation":1372},{"id":4,"title":5,"body":6,"description":1356,"extension":1357,"meta":1358,"navigation":1367,"path":1368,"seo":1369,"stem":1370,"__hash__":1371},"docs\u002F03.dethereal\u002F07.review-and-analysis.md","Review and Attack Surface Analysis",{"type":7,"value":8,"toc":1312},"minimark",[9,13,17,20,30,33,38,48,53,56,62,82,86,89,95,99,102,108,114,124,130,134,137,143,146,150,153,159,163,166,236,239,245,249,252,258,261,266,270,277,283,286,292,296,317,323,326,442,459,461,465,471,474,478,493,499,566,568,575,578,584,588,591,597,601,604,610,617,620,624,627,633,636,642,646,649,660,664,674,680,683,743,758,774,777,781,784,790,805,809,816,822,825,887,894,900,904,911,917,920,924,927,933,936,940,946,949,955,958,976,980,983,989,992,996,999,1005,1008,1012,1015,1021,1023,1027,1030,1133,1139,1148,1152,1155,1198,1201,1205,1211,1231,1242,1246,1249,1284,1287,1299,1301],[10,11,5],"h1",{"id":12},"review-and-attack-surface-analysis",[14,15,16],"p",{},"Two read-only commands help you assess your model's completeness and your system's security posture. Neither modifies model files.",[18,19],"hr",{},[21,22,24,25,29],"h2",{"id":23},"quality-review-detherealreview","Quality Review (",[26,27,28],"code",{},"\u002Fdethereal:review",")",[14,31,32],{},"The review command produces a quality dashboard showing how complete your model is and what gaps remain.",[34,35,37],"h3",{"id":36},"full-review-mode","Full Review Mode",[39,40,45],"pre",{"className":41,"code":43,"language":44},[42],"language-text","> \u002Fdethereal:review\n","text",[26,46,43],{"__ignoreMap":47},"",[49,50,52],"h4",{"id":51},"quality-score","Quality Score",[14,54,55],{},"The headline number is a 0-100 score measuring model completeness (not system security):",[39,57,60],{"className":58,"code":59,"language":44},[42],"Quality: 78\u002F100 (Good)\n",[26,61,59],{"__ignoreMap":47},[14,63,64,65,69,70,73,74,77,78,81],{},"Score labels: ",[66,67,68],"strong",{},"Starting"," (0-39), ",[66,71,72],{},"In Progress"," (40-69), ",[66,75,76],{},"Good"," (70-89), ",[66,79,80],{},"Comprehensive"," (90-100). Analysis readiness requires 70+.",[49,83,85],{"id":84},"factor-breakdown","Factor Breakdown",[14,87,88],{},"All 7 factors with their weights and contributions:",[39,90,93],{"className":91,"code":92,"language":44},[42],"Factor Breakdown\n| Factor                    | Score | Weight | Contribution |\n|---------------------------|-------|--------|-------------|\n| Component classification  | 100%  | 25     | 25.0        |\n| Attribute completion      |  80%  | 20     | 16.0        |\n| Boundary hierarchy        | 100%  | 15     | 15.0        |\n| Data flow coverage        |  90%  | 15     | 13.5        |\n| Data classification       |  60%  | 10     |  6.0        |\n| Control coverage          |  20%  | 10     |  2.0        |\n| Credential coverage       |  10%  |  5     |  0.5        |\n",[26,94,92],{"__ignoreMap":47},[49,96,98],{"id":97},"quality-gate-evaluation","Quality Gate Evaluation",[14,100,101],{},"Three progressive gates:",[39,103,106],{"className":104,"code":105,"language":44},[42],"Quality Gates\n  Gate 1 (Creation):  PASS — all advisory checks clear\n  Gate 2 (Sync):      PASS — structure valid, references intact\n  Gate 3 (Analysis):  FAIL — attribute completion at 60% (requires 80%)\n",[26,107,105],{"__ignoreMap":47},[14,109,110,113],{},[66,111,112],{},"Gate 1 (Creation, advisory):"," Flags issues without blocking — missing classifications, unnamed flows, single-component boundaries, external entities inside internal boundaries, cross-boundary flows without security controls.",[14,115,116,119,120,123],{},[66,117,118],{},"Gate 2 (Sync, blocking):"," Must pass before ",[26,121,122],{},"\u002Fdethereal:sync push"," — manifest completeness, structure validity (>= 1 boundary, 1 component, 1 data flow), reference integrity, no orphaned attribute files.",[14,125,126,129],{},[66,127,128],{},"Gate 3 (Analysis, blocking):"," Must pass for meaningful analysis — 100% component classification, >= 80% attribute completion, all trust boundary crossings reviewed, data items classified for sensitive flows, >= 1 cross-boundary data flow.",[49,131,133],{"id":132},"common-gaps-checklist","Common Gaps Checklist",[14,135,136],{},"Eight frequently missing elements, checked against your model:",[39,138,141],{"className":139,"code":140,"language":44},[42],"Common Gaps\n- [x] Administrative access paths\n- [ ] Monitoring\u002Flogging flows\n- [ ] Backup\u002Frecovery flows\n- [x] Trust boundary crossings have data flows\n- [ ] External dependencies (CDN, DNS, CA, registries)\n- [x] Human actors (developers, operators, support)\n- [ ] Bidirectional flows (request + response)\n- [ ] Error\u002Ffallback paths\n",[26,142,140],{"__ignoreMap":47},[14,144,145],{},"Detection is heuristic — the plugin scans flow names and descriptions for relevant patterns (e.g., \"SSH\", \"admin\", \"backup\", \"monitor\").",[49,147,149],{"id":148},"top-issues","Top Issues",[14,151,152],{},"The 3 most impactful gaps, ranked by severity:",[39,154,157],{"className":155,"code":156,"language":44},[42],"Top Issues\n1. [Critical] 2 components have no class assigned (Cache, Worker)\n2. [Warning]  Database has no attribute file — security properties unknown\n3. [Info]     No data items defined — data sensitivity cannot be assessed\n",[26,158,156],{"__ignoreMap":47},[49,160,162],{"id":161},"analysis-readiness","Analysis Readiness",[14,164,165],{},"Three assessment states:",[167,168,174],"div",{"className":169,"tabIndex":171,"role":172,"ariaLabel":173},[170],"table-frame",0,"region","Table: Analysis Readiness",[175,176,177,193],"table",{},[178,179,180],"thead",{},[181,182,183,187,190],"tr",{},[184,185,186],"th",{},"State",[184,188,189],{},"Criteria",[184,191,192],{},"Meaning",[194,195,196,210,223],"tbody",{},[181,197,198,204,207],{},[199,200,201],"td",{},[66,202,203],{},"PASS",[199,205,206],{},"Quality >= 70, all Gate 3 criteria met",[199,208,209],{},"Ready for platform analysis",[181,211,212,217,220],{},[199,213,214],{},[66,215,216],{},"PARTIAL",[199,218,219],{},"Quality 40-69, or >= 70 with Gate 3 failures",[199,221,222],{},"Analysis possible but results will have gaps",[181,224,225,230,233],{},[199,226,227],{},[66,228,229],{},"FAIL",[199,231,232],{},"Quality \u003C 40 or Gate 2 failures",[199,234,235],{},"Structural issues must be resolved first",[14,237,238],{},"If quality is >= 70 and Gate 3 passes but control and credential coverage are both 0%:",[240,241,242],"blockquote",{},[14,243,244],{},"Your model is structurally ready for analysis, but analysis quality will improve significantly with credentials (for lateral movement paths) and controls (for defense coverage gaps).",[49,246,248],{"id":247},"discovery-basis","Discovery Basis",[14,250,251],{},"If the model was created through discovery, a one-line provenance summary:",[39,253,256],{"className":254,"code":255,"language":44},[42],"Model based on: code analysis (10 components) + manual (2). Known gaps: 3.\n",[26,257,255],{"__ignoreMap":47},[14,259,260],{},"Plus a standing recommendation:",[240,262,263],{},[14,264,265],{},"Runtime Validation Recommended: This model reflects code-time infrastructure. Cross-reference with cloud asset inventory, DNS logs, or network flow data to identify shadow infrastructure not visible in code.",[49,267,269],{"id":268},"cross-model-gap-detection","Cross-Model Gap Detection",[14,271,272,273,276],{},"If the model references external models (via ",[26,274,275],{},"representedModel"," links), a warning:",[39,278,281],{"className":279,"code":280,"language":44},[42],"2 components reference external models. Attack paths through these\ncomponents are not included in this model's analysis.\n",[26,282,280],{"__ignoreMap":47},[14,284,285],{},"If the same credential appears in multiple local models:",[39,287,290],{"className":288,"code":289,"language":44},[42],"Credential \"db-admin\" is used in both \"API Layer\" and \"Data Platform\".\nLateral movement analysis cannot trace credential reuse across model boundaries.\n",[26,291,289],{"__ignoreMap":47},[49,293,295],{"id":294},"zoning-coherence-advisory","Zoning Coherence (Advisory)",[14,297,298,299,304,305,308,309,312,313,316],{},"If your model carries ",[300,301,303],"a",{"href":302},"\u002Fdethereal\u002Fmodel-concepts#trust-zones-planes-domains-and-conduits","trust zoning",", the review rolls up its ",[66,306,307],{},"zoning coherence"," — a set of advisory findings that check whether your declared segmentation hangs together. They are ",[66,310,311],{},"always advisory",": they inform you and ",[66,314,315],{},"never"," block a sync or fail a quality gate.",[39,318,321],{"className":319,"code":320,"language":44},[42],"Zoning Coherence (advisory)\n  [info] external-ingress: DMZ reaches Data Tier with no approved channel\n  [info] unclassified:      \"Legacy Gateway\" has no zone (defaults to INTERNAL)\n  [info] under-protected:   Data Tier holds an asset but resolves INTERNAL\n",[26,322,320],{"__ignoreMap":47},[14,324,325],{},"The six findings:",[167,327,330],{"className":328,"tabIndex":171,"role":172,"ariaLabel":329},[170],"Table: Zoning Coherence (Advisory)",[175,331,332,344],{},[178,333,334],{},[181,335,336,339,341],{},[184,337,338],{},"Finding",[184,340,192],{},[184,342,343],{},"Typical fix",[194,345,346,363,382,399,412,425],{},[181,347,348,353,360],{},[199,349,350],{},[26,351,352],{},"unclassified",[199,354,355,356,359],{},"A boundary has no zone anywhere up its chain and falls back to the default ",[26,357,358],{},"INTERNAL",".",[199,361,362],{},"Set its zone (or a declaring ancestor's) at Step 4.",[181,364,365,370,376],{},[199,366,367],{},[26,368,369],{},"under-protected",[199,371,372,373,359],{},"A boundary holding an asset directly resolves looser than ",[26,374,375],{},"RESTRICTED",[199,377,378,379,381],{},"Declare it ",[26,380,375],{},", or confirm the asset placement is intended.",[181,383,384,389,396],{},[199,385,386],{},[26,387,388],{},"mgmt-plane",[199,390,391,392,395],{},"A ",[26,393,394],{},"MANAGEMENT"," plane resolves to an exposed tier — an admin surface sitting where the internet can reach it.",[199,397,398],{},"Segment the management plane behind a stricter boundary.",[181,400,401,406,409],{},[199,402,403],{},[26,404,405],{},"external-ingress",[199,407,408],{},"An external-tier boundary reaches a trusted tier with no approved channel declared.",[199,410,411],{},"Ratify the crossing as an approved channel, or remove the flow.",[181,413,414,419,422],{},[199,415,416],{},[26,417,418],{},"flow-channel",[199,420,421],{},"A risk-bearing crossing diverges from its declared conduit (undeclared path, dead intent, or an unreviewable declaration).",[199,423,424],{},"Reconcile the flow and its approved channel — declare, remove, or add a justification.",[181,426,427,432,439],{},[199,428,429],{},[26,430,431],{},"cross-tier-domain",[199,433,434,435,438],{},"A shared ",[26,436,437],{},"domains"," tag couples an externally-reachable boundary with a protected one — a co-tenancy \u002F blast-radius shape. Fires only when you hand-author matching tags.",[199,440,441],{},"Review whether the exposed and protected segments should share that domain.",[14,443,444,445,449,450,454,455,359],{},"Zoning records ",[446,447,448],"em",{},"declared design intent"," — the platform records it but does not verify or enforce it. These findings surface where the modeled reality diverges from what you declared. For setting zones and approved channels, see the platform guide ",[300,451,453],{"href":452},"\u002Fplatform\u002Fboundary-trust-zones","Boundary Trust Zones","; for where zoning is ratified during modeling, see the ",[300,456,458],{"href":457},"\u002Fdethereal\u002Fguided-workflow","Guided Workflow",[18,460],{},[34,462,464],{"id":463},"structure-only-mode","Structure-Only Mode",[39,466,469],{"className":467,"code":468,"language":44},[42],"> \u002Fdethereal:review --structure-only\n",[26,470,468],{"__ignoreMap":47},[14,472,473],{},"A lightweight validation without quality scoring. Useful for catching errors before enrichment.",[49,475,477],{"id":476},"what-it-checks","What It Checks",[14,479,480,481,484,485,488,489,492],{},"8 structural checks, each reported as ",[26,482,483],{},"[PASS]",", ",[26,486,487],{},"[FAIL]",", or ",[26,490,491],{},"[WARN]",":",[39,494,497],{"className":495,"code":496,"language":44},[42],"Structural Validation: Payment API\n\nChecks:\n  [PASS] Required fields present\n  [PASS] ID uniqueness (14 elements, 0 duplicates)\n  [FAIL] Reference integrity: 1 flow references missing component\n    - Flow \"cache-read\" references target \"old-redis\" (not found)\n  [WARN] 1 orphaned component: \"Legacy Gateway\" (no data flows)\n  [PASS] No empty boundaries\n  [PASS] No orphaned attribute files\n  [PASS] No component\u002Fclass type mismatches\n  [PASS] Schema validation passed\n\nResult: 1 failure, 1 warning. Fix reference integrity before sync.\n",[26,498,496],{"__ignoreMap":47},[500,501,502,509,515,521,527,533,539,560],"ol",{},[503,504,505,508],"li",{},[66,506,507],{},"Required fields"," — manifest has name and description, structure has boundaries, dataflows has flows",[503,510,511,514],{},[66,512,513],{},"ID uniqueness"," — no duplicate IDs across all model files",[503,516,517,520],{},[66,518,519],{},"Reference integrity"," — all data flow source\u002Ftarget IDs exist in structure.json",[503,522,523,526],{},[66,524,525],{},"Orphaned components"," — components with no inbound or outbound data flows (warning)",[503,528,529,532],{},[66,530,531],{},"Empty boundaries"," — boundaries with no child components or sub-boundaries (warning)",[503,534,535,538],{},[66,536,537],{},"Orphaned attribute files"," — attribute files whose element ID no longer exists (warning)",[503,540,541,544,545,548,549,552,553,556,557],{},[66,542,543],{},"Component\u002Fclass type mismatch"," — a component whose ",[26,546,547],{},"type"," disagrees with the component type its assigned class describes, e.g. a ",[26,550,551],{},"STORE"," bound to a class written for a ",[26,554,555],{},"PROCESS"," (warning). This is a real defect, not a cosmetic one: the class's policy evaluates against a thing it does not describe. Fix it by correcting either the component type or the class assignment. The check needs a cached class template, so it is skipped for classes not present in ",[26,558,559],{},".dethereal\u002Fclass-cache\u002F",[503,561,562,565],{},[66,563,564],{},"Schema compliance"," — full schema validation against the platform schema",[18,567],{},[21,569,571,572,29],{"id":570},"attack-surface-analysis-detherealsurface","Attack Surface Analysis (",[26,573,574],{},"\u002Fdethereal:surface",[14,576,577],{},"The surface command produces a structured overview of your system's attack surface — where the security boundaries are, what's exposed, and where controls are missing.",[39,579,582],{"className":580,"code":581,"language":44},[42],"> \u002Fdethereal:surface\n",[26,583,581],{"__ignoreMap":47},[34,585,587],{"id":586},"_1-component-breakdown","1. Component Breakdown",[14,589,590],{},"Components grouped by boundary and type:",[39,592,595],{"className":593,"code":594,"language":44},[42],"Components (9 total)\n| Boundary        | PROCESS | STORE | EXTERNAL_ENTITY | Total |\n|-----------------|---------|-------|-----------------|-------|\n| External        | 0       | 0     | 2               | 2     |\n| DMZ             | 2       | 0     | 0               | 2     |\n| Internal        | 3       | 0     | 0               | 3     |\n| Data Tier       | 0       | 2     | 0               | 2     |\n",[26,596,594],{"__ignoreMap":47},[34,598,600],{"id":599},"_2-trust-boundary-crossings","2. Trust Boundary Crossings",[14,602,603],{},"Flows where source and target are in different boundaries, with encryption and authentication status:",[39,605,608],{"className":606,"code":607,"language":44},[42],"Trust Boundary Crossings (6 flows)\n| From → To          | Flow Count | Encrypted   | Authenticated | Enforcement  |\n|---------------------|-----------|-------------|---------------|-------------|\n| External → DMZ      | 2         | 2\u002F2 TLS     | 1\u002F2           | enforced    |\n| DMZ → Internal      | 2         | 2\u002F2 mTLS    | 2\u002F2           | enforced    |\n| Internal → Data     | 2         | 1\u002F2         | 2\u002F2           | logical only |\n",[26,609,607],{"__ignoreMap":47},[14,611,612,613,616],{},"Flows with ",[26,614,615],{},"auth_failure_mode: fail_open"," are annotated — they appear authenticated but provide no security guarantee on failure. Boundary enforcement is \"enforced\" (implicit deny + egress filtering) or \"logical only.\"",[14,618,619],{},"Unencrypted, unauthenticated, or fail-open cross-boundary flows are highlighted as high-priority control gaps.",[34,621,623],{"id":622},"_3-exposure-counts","3. Exposure Counts",[14,625,626],{},"If the model has been pushed to the platform and analysis has run:",[39,628,631],{"className":629,"code":630,"language":44},[42],"Exposures\n  12 exposures across 5 components.\n  Top affected: payment-db (4 exposures)\n",[26,632,630],{"__ignoreMap":47},[14,634,635],{},"If not synced:",[39,637,640],{"className":638,"code":639,"language":44},[42],"Exposures\n  Model not synced — push to platform for exposure analysis.\n  Run \u002Fdethereal:sync push to publish.\n",[26,641,639],{"__ignoreMap":47},[34,643,645],{"id":644},"_4-control-coverage-and-gap-analysis","4. Control Coverage and Gap Analysis",[14,647,648],{},"This is the longest section of the report, and it is deliberately not a single number. Coverage is reported in up to five parts, because \"covered\" means different things depending on where the evidence came from.",[14,650,651,652,655,656,659],{},"The two you always get are ",[66,653,654],{},"inferred"," coverage — read from the security attributes you set during enrichment — and ",[66,657,658],{},"formal"," coverage — read from the controls actually assigned to elements. A synced model adds MITRE-grounded gap analysis on top; two further parts appear only when you have the data they describe.",[49,661,663],{"id":662},"_4a-mitre-grounded-gap-analysis","4a. MITRE-grounded gap analysis",[14,665,666,669,670,673],{},[66,667,668],{},"Requires a platform sync."," This part is skipped entirely on a model that has never been pushed — the analysis walks the platform's ",[26,671,672],{},"Exposure → ATT&CK Technique → ATT&CK Mitigation → Countermeasure → Control"," chain, and there are no platform exposures to walk from until you sync.",[39,675,678],{"className":676,"code":677,"language":44},[42],"### MITRE-Grounded Gap Analysis\n  N unmitigated exposures (addressable), M unaddressable (module gap), K with no MITRE chain.\n\n  Unmitigated:\n    api-server: SQL Injection (T1190 → M1016 Vulnerability Scanning)\n    payment-db: Data Manipulation (T1565 → M1041 Encrypt Sensitive Info)\n\n  Recommended Controls:\n    1. WAF Protection — addresses 3 techniques, D3FEND: D3-WSAA\n    2. DB Encryption (PG) — addresses 2 techniques, D3FEND: D3-DENCR\n\n  Unaddressable (module gap — no installed ControlClass):\n    scheduler: Resource Hijacking (T1496 → M1047)\n",[26,679,677],{"__ignoreMap":47},[14,681,682],{},"Read the three counts as three different problems:",[167,684,687],{"className":685,"tabIndex":171,"role":172,"ariaLabel":686},[170],"Table: 4a. MITRE-grounded gap analysis",[175,688,689,702],{},[178,690,691],{},[181,692,693,696,699],{},[184,694,695],{},"Bucket",[184,697,698],{},"What it means",[184,700,701],{},"What to do",[194,703,704,717,730],{},[181,705,706,711,714],{},[199,707,708],{},[66,709,710],{},"Unmitigated (addressable)",[199,712,713],{},"A real gap you can close today — an ATT&CK mitigation exists, and an installed module provides a control class that implements it.",[199,715,716],{},"Assign the recommended control.",[181,718,719,724,727],{},[199,720,721],{},[66,722,723],{},"Unaddressable (module gap)",[199,725,726],{},"The mitigation exists in ATT&CK, but no installed module supplies a control class for it.",[199,728,729],{},"Install a module that covers it, or handle it outside the platform.",[181,731,732,737,740],{},[199,733,734],{},[66,735,736],{},"No MITRE chain",[199,738,739],{},"The exposure carries no ATT&CK technique mapping, so it cannot be traced through the framework chain at all.",[199,741,742],{},"Judge it manually — the framework has nothing to say about it.",[14,744,745,746,749,750,753,754,757],{},"Two more numbers appear alongside them. ",[66,747,748],{},"Configured but non-matching"," counts controls that ",[446,751,752],{},"are"," assigned to an element but address different techniques — coverage that looks reassuring on the element and does nothing for that exposure. ",[66,755,756],{},"Recommended controls"," are type-compatible candidates, each with its D3FEND links and the number of techniques it would address.",[240,759,760],{},[14,761,762,765,766,769,770,359],{},[66,763,764],{},"Recommendations are per control class, not per control."," Several recommended rows naming related classes for the same mechanism are often satisfied by ",[66,767,768],{},"one"," control carrying several classes — not one control per row. See ",[300,771,773],{"href":772},"\u002Fplatform\u002Fworking-with-security-controls","Working with Security Controls",[14,775,776],{},"If the platform call fails — expired auth, network error — the report falls back to what it can read from your local files (4c below).",[49,778,780],{"id":779},"_4b-inferred-coverage-from-enrichment-attributes","4b. Inferred coverage (from enrichment attributes)",[14,782,783],{},"Computed locally from the attributes you set during enrichment, broken down by protection category:",[39,785,788],{"className":786,"code":787,"language":44},[42],"### Inferred Coverage (from enrichment attributes)\n\n| Protection | Coverage | Missing |\n|------------|----------|---------|\n| Authentication | 10\u002F12 (83%) | scheduler, batch-worker |\n| Encryption in transit | 8\u002F10 cross-boundary flows (80%) | internal→data-tier, worker→queue |\n| Encryption at rest | 3\u002F4 stores (75%) | session-cache |\n| Monitoring | 6\u002F12 (50%) | scheduler, batch-worker, config-svc, ... |\n",[26,789,787],{"__ignoreMap":47},[14,791,792,793,796,797,800,801,804],{},"The report labels this honestly, and so should you: it is ",[66,794,795],{},"sufficient for a security posture review, insufficient as compliance evidence",". An ",[26,798,799],{},"authentication: oauth2"," attribute is your assertion that the component authenticates — it is not a control anyone has assigned, reviewed, or verified. Run ",[26,802,803],{},"\u002Fdethereal:enrich"," to fill the gaps it names.",[49,806,808],{"id":807},"_4c-formal-control-coverage-from-assigned-controls","4c. Formal control coverage (from assigned controls)",[14,810,811,812,815],{},"The same question asked of ",[446,813,814],{},"assigned controls"," rather than attributes, broken down by enrichment tier:",[39,817,820],{"className":818,"code":819,"language":44},[42],"### Formal Control Coverage (from assigned controls)\n\n| Tier | Components | With Controls | Gap |\n|------|------------|---------------|-----|\n| 1 — Crown Jewels | 3 | 2 (67%) | payment-db |\n| 2 — Cross-boundary | 4 | 1 (25%) | api-gw, auth-svc, msg-queue |\n| 3 — Internet-facing | 2 | 2 (100%) | — |\n| 4 — Internal | 3 | 0 (0%) | scheduler, batch-worker, config-svc |\n| **Total** | **12** | **5 (42%)** | **7 components without formal controls** |\n",[26,821,819],{"__ignoreMap":47},[14,823,824],{},"The four tiers are:",[167,826,829],{"className":827,"tabIndex":171,"role":172,"ariaLabel":828},[170],"Table: 4c. Formal control coverage (from assigned controls)",[175,830,831,841],{},[178,832,833],{},[181,834,835,838],{},[184,836,837],{},"Tier",[184,839,840],{},"Definition",[194,842,843,857,867,877],{},[181,844,845,850],{},[199,846,847],{},[66,848,849],{},"1 — Crown jewels",[199,851,852,853,856],{},"Components you tagged ",[26,854,855],{},"crownJewel"," during classification.",[181,858,859,864],{},[199,860,861],{},[66,862,863],{},"2 — Cross-boundary",[199,865,866],{},"Source or target of a flow that crosses a trust boundary.",[181,868,869,874],{},[199,870,871],{},[66,872,873],{},"3 — Internet-facing",[199,875,876],{},"Connected to an external entity by a data flow.",[181,878,879,884],{},[199,880,881],{},[66,882,883],{},"4 — Internal",[199,885,886],{},"Everything else.",[14,888,889,890,893],{},"Each component appears in its ",[66,891,892],{},"highest-priority tier only"," — a crown jewel that is also cross-boundary appears in Tier 1 and nowhere else, so the tier totals add up to your component count.",[14,895,896,897,359],{},"This is the coverage figure that stands up as evidence, which is why the report names the frameworks it serves (SOC 2 CC6.1, ISO 27001 A.8, PCI-DSS 6.x). Close a gap with ",[26,898,899],{},"\u002Fdethereal:enrich --focus controls",[49,901,903],{"id":902},"_4d-control-source-breakdown","4d. Control source breakdown",[14,905,906,907,910],{},"Appears only when your controls carry a ",[26,908,909],{},"source"," field. It separates controls the plugin found evidence for during discovery from controls you asserted yourself:",[39,912,915],{"className":913,"code":914,"language":44},[42],"### Control Verification Status\n\n| Source | Controls | Note |\n|--------|----------|------|\n| Discovered (verified in code\u002FIaC) | 8 | Full confidence — implementation confirmed |\n| Declared (user-asserted) | 5 | Assumed effective, unverified |\n| Both (discovered + declared) | 2 | Highest confidence — governed and verified |\n",[26,916,914],{"__ignoreMap":47},[14,918,919],{},"A control that is both discovered and declared is the strongest statement available: someone wrote the policy down, and the implementation was found.",[49,921,923],{"id":922},"_4e-governance-controls","4e. Governance controls",[14,925,926],{},"Appears only when you declared governance controls during the enrichment control pass — the organizational measures that protect the system without living in any one component:",[39,928,931],{"className":929,"code":930,"language":44},[42],"### Governance Controls (declared)\n  - Patch management: monthly patching cycle\n  - Access reviews: quarterly\n  - Change control: CAB approval required for production\n",[26,932,930],{"__ignoreMap":47},[14,934,935],{},"These are listed, not scored. They have no element to attach to, so they contribute nothing to 4b or 4c — the section exists so a reviewer sees them rather than assuming they don't exist.",[34,937,939],{"id":938},"_5-mitre-attck-coverage","5. MITRE ATT&CK Coverage",[14,941,942,945],{},[66,943,944],{},"This section requires a platform sync and a completed analysis."," Tactic coverage is derived from the techniques the analysis engine attaches to exposures — the plugin does not maintain its own client-side technique annotation, so enriching components alone produces no coverage here.",[14,947,948],{},"When exposures are available, their techniques are aggregated and deduplicated to show which of the 15 Enterprise ATT&CK tactics are covered:",[39,950,953],{"className":951,"code":952,"language":44},[42],"MITRE ATT&CK Coverage (platform-derived)\n  Techniques mapped: 12\n  Tactics covered (5\u002F15): Initial Access, Credential Access, Lateral Movement,\n    Collection, Exfiltration\n  Tactics not covered: Reconnaissance, Resource Development, Execution, Persistence,\n    Privilege Escalation, Stealth, Defense Impairment, Discovery, Command and Control,\n    Impact\n",[26,954,952],{"__ignoreMap":47},[14,956,957],{},"Two cases produce no coverage instead:",[959,960,961,970],"ul",{},[503,962,963,966,967,969],{},[66,964,965],{},"Model not synced:"," \"Model not synced — push to platform and run an analysis for MITRE tactic coverage.\" Run ",[26,968,122],{},", then start an analysis.",[503,971,972,975],{},[66,973,974],{},"Synced, but no exposures yet:"," \"No exposures — analysis has not produced technique mappings yet.\" Either the analysis has not run, or no installed module has policies covering this model's components.",[34,977,979],{"id":978},"_6-credential-topology","6. Credential Topology",[14,981,982],{},"Credential usage across the model:",[39,984,987],{"className":985,"code":986,"language":44},[42],"Credential Topology\n  8 flows with credentials, 2 shared credentials\n  Credential blast radius: db-admin (used by 3 flows across 2 boundaries)\n  Credential stores: PostgreSQL, Redis (stores_credentials: true)\n",[26,988,986],{"__ignoreMap":47},[14,990,991],{},"Shared credentials (same credential on multiple flows) flag the blast radius of a credential compromise.",[34,993,995],{"id":994},"_7-detection-coverage","7. Detection Coverage",[14,997,998],{},"Monitoring tool presence across components:",[39,1000,1003],{"className":1001,"code":1002,"language":44},[42],"Detection Coverage\n  Monitored: 6 components (SIEM: 4, EDR: 3, NDR: 1)\n  Blind spots: worker, scheduler (no monitoring tools configured)\n",[26,1004,1002],{"__ignoreMap":47},[14,1006,1007],{},"Components without any monitoring tools are SOC blind spots — security events on those components are invisible to detection and response.",[34,1009,1011],{"id":1010},"_8-cross-model-analysis-boundaries","8. Cross-Model Analysis Boundaries",[14,1013,1014],{},"If the model references external models:",[39,1016,1019],{"className":1017,"code":1018,"language":44},[42],"Cross-Model Analysis Boundaries\n  2 components reference external models. Attack paths through these\n  components are not included in this model's analysis.\n",[26,1020,1018],{"__ignoreMap":47},[18,1022],{},[21,1024,1026],{"id":1025},"local-vs-platform-analysis","Local vs. Platform Analysis",[14,1028,1029],{},"Understanding which analysis requires platform sync:",[167,1031,1034],{"className":1032,"tabIndex":171,"role":172,"ariaLabel":1033},[170],"Table: Local vs. Platform Analysis",[175,1035,1036,1049],{},[178,1037,1038],{},[181,1039,1040,1043,1046],{},[184,1041,1042],{},"Analysis",[184,1044,1045],{},"Source",[184,1047,1048],{},"Requires Platform Sync?",[194,1050,1051,1064,1075,1089,1103,1115,1124],{},[181,1052,1053,1056,1061],{},[199,1054,1055],{},"Quality score, structural validation",[199,1057,1058,1059,29],{},"Local (",[26,1060,28],{},[199,1062,1063],{},"No",[181,1065,1066,1069,1073],{},[199,1067,1068],{},"Boundary crossing matrix, credential topology, detection coverage",[199,1070,1058,1071,29],{},[26,1072,574],{},[199,1074,1063],{},[181,1076,1077,1083,1087],{},[199,1078,1079,1080,1082],{},"Inferred and formal control coverage (",[26,1081,574],{}," §4b, §4c)",[199,1084,1058,1085,29],{},[26,1086,574],{},[199,1088,1063],{},[181,1090,1091,1097,1100],{},[199,1092,1093,1094,1096],{},"MITRE-grounded gap analysis (",[26,1095,574],{}," §4a)",[199,1098,1099],{},"Platform analysis engine",[199,1101,1102],{},"Yes",[181,1104,1105,1111,1113],{},[199,1106,1107,1108,1110],{},"MITRE ATT&CK tactic coverage (",[26,1109,574],{}," §5)",[199,1112,1099],{},[199,1114,1102],{},[181,1116,1117,1120,1122],{},[199,1118,1119],{},"Exposures, attack paths",[199,1121,1099],{},[199,1123,1102],{},[181,1125,1126,1129,1131],{},[199,1127,1128],{},"Countermeasure coverage, defense gaps",[199,1130,1099],{},[199,1132,1102],{},[14,1134,1135,1136,1138],{},"Local analysis runs entirely from model files — you can review quality and most of the attack surface without a platform connection. ",[26,1137,574],{}," still runs offline, but three of its parts come from the platform and are reported as unavailable until you push and run an analysis: exposure counts (§3), MITRE-grounded gap analysis (§4a), and MITRE tactic coverage (§5).",[14,1140,1141,1144,1145,1147],{},[66,1142,1143],{},"\"Control gaps\" is not one thing."," The tier gap table in §4c is computed from your local files and needs no sync. The MITRE-grounded gap analysis in §4a — the one that names techniques, mitigations, and recommended controls — needs one. If you run ",[26,1146,574],{}," offline and see tier gaps but no MITRE chain, that is the reason.",[34,1149,1151],{"id":1150},"prioritization-guidance","Prioritization Guidance",[14,1153,1154],{},"When reviewing results, prioritize remediation in this order:",[500,1156,1157,1163,1169,1186,1192],{},[503,1158,1159,1162],{},[66,1160,1161],{},"Internet-facing components"," — directly reachable from external sources",[503,1164,1165,1168],{},[66,1166,1167],{},"Data stores"," — especially those holding credentials or regulated data",[503,1170,1171,1174,1175,1178,1179,1182,1183],{},[66,1172,1173],{},"Authentication paths"," — flows where ",[26,1176,1177],{},"auth_failure_mode"," is ",[26,1180,1181],{},"fail_open"," or ",[26,1184,1185],{},"fallback",[503,1187,1188,1191],{},[66,1189,1190],{},"Cross-boundary flows"," — data moving between trust zones",[503,1193,1194,1197],{},[66,1195,1196],{},"Administrative access paths"," — management and maintenance interfaces",[14,1199,1200],{},"This order reflects the enrichment tier rationale: the highest-exposure surfaces get attention first.",[21,1202,1204],{"id":1203},"understanding-platform-analysis","Understanding Platform Analysis",[14,1206,1207,1208,1210],{},"After pushing your model (",[26,1209,122],{},"), the platform runs its analysis engine, which computes:",[959,1212,1213,1219,1225],{},[503,1214,1215,1218],{},[66,1216,1217],{},"Exposures"," — potential vulnerabilities specific to your model's structure and attributes",[503,1220,1221,1224],{},[66,1222,1223],{},"Countermeasures"," — links between your security controls and the exposures they address",[503,1226,1227,1230],{},[66,1228,1229],{},"Attack paths"," — how an attacker could move through your system (graph traversal)",[14,1232,1233,1234,1236,1237,1241],{},"These computed artifacts live on the platform, not in your local files. Run ",[26,1235,574],{}," after analysis to see the results. For details on interpreting analysis output, see the platform's ",[300,1238,1240],{"href":1239},"\u002Fplatform\u002Fsecurity-analysis-workflow","Security Analysis Workflow"," guide.",[21,1243,1245],{"id":1244},"what-happens-after-analysis","What Happens After Analysis",[14,1247,1248],{},"After platform analysis completes:",[500,1250,1251,1260,1266,1272,1278],{},[503,1252,1253,1256,1257,1259],{},[66,1254,1255],{},"Review findings"," — run ",[26,1258,574],{}," to see exposures and control gaps",[503,1261,1262,1265],{},[66,1263,1264],{},"Create controls"," — add security controls through the platform GUI to address identified exposures",[503,1267,1268,1271],{},[66,1269,1270],{},"Link countermeasures"," — connect controls to exposures so defense coverage analysis credits existing defenses",[503,1273,1274,1277],{},[66,1275,1276],{},"Track remediation"," — use the platform's issue management to create, assign, and track resolution of findings",[503,1279,1280,1283],{},[66,1281,1282],{},"Iterate"," — refine the model locally, re-publish, and re-analyze as your system evolves",[14,1285,1286],{},"For managing security controls and issues discovered through analysis, see:",[959,1288,1289,1293],{},[503,1290,1291],{},[300,1292,773],{"href":772},[503,1294,1295],{},[300,1296,1298],{"href":1297},"\u002Fplatform\u002Fissue-management-guide","Issue Management Guide",[18,1300],{},[14,1302,1303,1306,1307,1311],{},[66,1304,1305],{},"Next:"," ",[300,1308,1310],{"href":1309},"\u002Fdethereal\u002Fagents-and-architecture","Agents, Tools, and Hooks"," — how the plugin works under the hood",{"title":47,"searchDepth":1313,"depth":1313,"links":1314},3,[1315,1334,1351,1354,1355],{"id":23,"depth":1316,"text":1317,"children":1318},2,"Quality Review (\u002Fdethereal:review)",[1319,1331],{"id":36,"depth":1313,"text":37,"children":1320},[1321,1323,1324,1325,1326,1327,1328,1329,1330],{"id":51,"depth":1322,"text":52},4,{"id":84,"depth":1322,"text":85},{"id":97,"depth":1322,"text":98},{"id":132,"depth":1322,"text":133},{"id":148,"depth":1322,"text":149},{"id":161,"depth":1322,"text":162},{"id":247,"depth":1322,"text":248},{"id":268,"depth":1322,"text":269},{"id":294,"depth":1322,"text":295},{"id":463,"depth":1313,"text":464,"children":1332},[1333],{"id":476,"depth":1322,"text":477},{"id":570,"depth":1316,"text":1335,"children":1336},"Attack Surface Analysis (\u002Fdethereal:surface)",[1337,1338,1339,1340,1347,1348,1349,1350],{"id":586,"depth":1313,"text":587},{"id":599,"depth":1313,"text":600},{"id":622,"depth":1313,"text":623},{"id":644,"depth":1313,"text":645,"children":1341},[1342,1343,1344,1345,1346],{"id":662,"depth":1322,"text":663},{"id":779,"depth":1322,"text":780},{"id":807,"depth":1322,"text":808},{"id":902,"depth":1322,"text":903},{"id":922,"depth":1322,"text":923},{"id":938,"depth":1313,"text":939},{"id":978,"depth":1313,"text":979},{"id":994,"depth":1313,"text":995},{"id":1010,"depth":1313,"text":1011},{"id":1025,"depth":1316,"text":1026,"children":1352},[1353],{"id":1150,"depth":1313,"text":1151},{"id":1203,"depth":1316,"text":1204},{"id":1244,"depth":1316,"text":1245},"Quality review, attack surface summary, and platform analysis integration","md",{"category":1359,"position":1360,"tags":1361},"documentation",8,[1362,1363,1364,1365,1366],"dethereal","review","quality","attack-surface","analysis",true,"\u002Fdethereal\u002Freview-and-analysis",{"title":5,"description":1356},"03.dethereal\u002F07.review-and-analysis","QrcMOhaynTZXAsRvSM4nQ9drXscqsFiZGDFmpWJECbg",[1373,1420,1455,1503,1537,1581,1596,1666],{"title":1374,"description":1375,"path":1376,"stem":1377,"children":1378,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[1379,1383,1388,1393,1396,1401,1404,1407,1410,1415],{"title":1380,"path":1376,"stem":1381,"description":1382},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":1384,"path":1385,"stem":1386,"description":1387},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":1389,"path":1390,"stem":1391,"description":1392},"Building Your First Model","\u002Fplatform\u002Fbuilding-your-first-model","01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":1240,"path":1239,"stem":1394,"description":1395},"01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":1397,"path":1398,"stem":1399,"description":1400},"Managing Findings","\u002Fplatform\u002Fmanaging-findings","01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":773,"path":772,"stem":1402,"description":1403},"01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":1298,"path":1297,"stem":1405,"description":1406},"01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":453,"path":452,"stem":1408,"description":1409},"01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":1411,"path":1412,"stem":1413,"description":1414},"Understanding Modules","\u002Fplatform\u002Funderstanding-modules","01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":1416,"path":1417,"stem":1418,"description":1419},"Component Configuration Guide","\u002Fplatform\u002Fcomponent-configuration-guide","01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":1421,"description":1422,"path":1423,"stem":1424,"children":1425,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[1426,1430,1435,1440,1445,1450],{"title":1427,"path":1423,"stem":1428,"description":1429},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":1431,"path":1432,"stem":1433,"description":1434},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":1436,"path":1437,"stem":1438,"description":1439},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":1441,"path":1442,"stem":1443,"description":1444},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":1446,"path":1447,"stem":1448,"description":1449},"Connecting the BYODt Deployment to the Cloud","\u002Fbyodt-cloud\u002Fcloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":1451,"path":1452,"stem":1453,"description":1454},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":1456,"description":1457,"path":1458,"stem":1459,"children":1460,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[1461,1465,1470,1474,1479,1484,1489,1494,1495,1498],{"title":1462,"path":1458,"stem":1463,"description":1464},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":1466,"path":1467,"stem":1468,"description":1469},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":1471,"path":457,"stem":1472,"description":1473},"The 11-Step Guided Workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":1475,"path":1476,"stem":1477,"description":1478},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":1480,"path":1481,"stem":1482,"description":1483},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":1485,"path":1486,"stem":1487,"description":1488},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":1490,"path":1491,"stem":1492,"description":1493},"Sync and Version Control","\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":5,"path":1368,"stem":1370,"description":1356},{"title":1310,"path":1309,"stem":1496,"description":1497},"03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":1499,"path":1500,"stem":1501,"description":1502},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":1504,"description":1505,"path":1506,"stem":1507,"children":1508,"page":-1},"Threat Report","The residual-risk report over a threat model: reading it, filtering it and exporting it.","\u002Fthreat-report","04.threat-report",[1509,1512,1517,1522,1527,1532],{"title":1504,"path":1506,"stem":1510,"description":1511},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":1513,"path":1514,"stem":1515,"description":1516},"Getting Started with the Threat Report","\u002Fthreat-report\u002Fgetting-started","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":1518,"path":1519,"stem":1520,"description":1521},"Reading the Report","\u002Fthreat-report\u002Freading-the-report","04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":1523,"path":1524,"stem":1525,"description":1526},"Understanding Coverage and Gaps","\u002Fthreat-report\u002Funderstanding-coverage","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":1528,"path":1529,"stem":1530,"description":1531},"Reachability and Flow Routes","\u002Fthreat-report\u002Freachability","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":1533,"path":1534,"stem":1535,"description":1536},"Working with Findings","\u002Fthreat-report\u002Fworking-with-findings","04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":1538,"description":1539,"path":1540,"stem":1541,"children":1542,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","\u002Frisk-assessment","05.risk-assessment",[1543,1547,1552,1557,1562,1567,1571,1576],{"title":1544,"path":1540,"stem":1545,"description":1546},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":1548,"path":1549,"stem":1550,"description":1551},"FAQ and Troubleshooting","\u002Frisk-assessment\u002Ffaq","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":1553,"path":1554,"stem":1555,"description":1556},"Findings","\u002Frisk-assessment\u002Ffindings","05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":1558,"path":1559,"stem":1560,"description":1561},"Getting Started","\u002Frisk-assessment\u002Fgetting-started","05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":1563,"path":1564,"stem":1565,"description":1566},"Methodology and Trust","\u002Frisk-assessment\u002Fmethodology-and-trust","05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":1518,"path":1568,"stem":1569,"description":1570},"\u002Frisk-assessment\u002Freading-the-report","05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":1572,"path":1573,"stem":1574,"description":1575},"Stakeholder Reports and Exports","\u002Frisk-assessment\u002Fstakeholder-reports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":1577,"path":1578,"stem":1579,"description":1580},"The Risk Register","\u002Frisk-assessment\u002Fthe-risk-register","05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":1582,"description":1583,"path":1584,"stem":1585,"children":1586,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[1587,1591],{"title":1588,"path":1584,"stem":1589,"description":1590},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":1592,"path":1593,"stem":1594,"description":1595},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":1597,"description":1598,"path":1599,"stem":1600,"children":1601,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","\u002Fagentic-modelling","07.agentic-modelling",[1602,1606,1611,1616,1621,1626,1631,1636,1641,1646,1651,1656,1661],{"title":1603,"path":1599,"stem":1604,"description":1605},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":1607,"path":1608,"stem":1609,"description":1610},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":1612,"path":1613,"stem":1614,"description":1615},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":1617,"path":1618,"stem":1619,"description":1620},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":1622,"path":1623,"stem":1624,"description":1625},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":1627,"path":1628,"stem":1629,"description":1630},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":1632,"path":1633,"stem":1634,"description":1635},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":1637,"path":1638,"stem":1639,"description":1640},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":1642,"path":1643,"stem":1644,"description":1645},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":1647,"path":1648,"stem":1649,"description":1650},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":1652,"path":1653,"stem":1654,"description":1655},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":1657,"path":1658,"stem":1659,"description":1660},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":1662,"path":1663,"stem":1664,"description":1665},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":1667,"description":1668,"path":1669,"stem":1670,"children":1671,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[1672,1676,1681],{"title":1673,"path":1669,"stem":1674,"description":1675},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":1677,"path":1678,"stem":1679,"description":1680},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":1682,"path":1683,"stem":1684,"description":1685},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748185227]