[{"data":1,"prerenderedAt":1241},["ShallowReactive",2],{"page-\u002Frisk-assessment\u002Ffindings":3,"navigation":926},{"id":4,"title":5,"body":6,"description":918,"extension":919,"meta":920,"navigation":921,"path":922,"seo":923,"stem":924,"__hash__":925},"docs\u002F05.risk-assessment\u002F02.findings.md","Findings",{"type":7,"value":8,"toc":892},"minimark",[9,13,22,29,54,57,73,86,91,94,135,138,160,165,168,195,202,215,218,221,242,266,284,288,441,444,447,450,454,460,466,472,476,485,490,495,507,511,516,521,530,534,547,552,557,561,574,579,584,589,593,623,645,649,658,663,668,682,686,695,702,707,711,720,732,737,741,750,757,762,766,775,801,806,815,827,831,849,853],[10,11,5],"h1",{"id":12},"findings",[14,15,16,17,21],"p",{},"A ",[18,19,20],"strong",{},"finding"," is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",[14,23,24,25,28],{},"The Risk Assessment surfaces ",[18,26,27],{},"ten kinds of finding",", in two families:",[30,31,32,39],"ul",{},[33,34,35,38],"li",{},[18,36,37],{},"Control-gap findings (F1–F5)"," ask whether the protections around a risk are present where the architecture says they should be. They look along the routes an attacker's activity could travel and at the elements on your entry surface, and they flag places where an expected detection, isolation, or mitigating control is missing.",[33,40,41,44,45,49,50,53],{},[18,42,43],{},"Architectural and data-flow, or \"zoning\", findings (F6–F10)"," ask whether the flows ",[46,47,48],"em",{},"between your trust zones"," respect the zoning policy your model expresses. They judge the model ",[18,51,52],{},"as you have drawn it"," — the declared zones, conduits, planes, and domains — and flag crossings the policy forbids or would want you to review.",[14,55,56],{},"Every finding type carries a short code (F1 through F10) and a display name, both shown on screen. This guide uses the same codes and names so you can move between the product and this reference without translation.",[58,59,60],"blockquote",{},[14,61,62,63,66,67,72],{},"A finding is an invitation to investigate, never a verdict. It tells you ",[46,64,65],{},"\"look here, and here is why.\""," It does not claim your system is broken, and — just as important — a control sitting near a finding is never treated as proof the finding is closed. See ",[68,69,71],"a",{"href":70},"#what-a-finding-is-and-is-not","What a finding is, and is not"," below.",[14,74,75,76,80,81,85],{},"For the trust rationale behind every claim a finding makes — why the ratings are bands and counts rather than invented scores, and why the wording is deliberately cautious — see ",[68,77,79],{"href":78},"\u002Frisk-assessment\u002Fmethodology-and-trust","Methodology and Trust",". For how to scan the Findings surface in the report and drill from a finding into the elements it names, see ",[68,82,84],{"href":83},"\u002Frisk-assessment\u002Freading-the-report#findings","Reading the Report",".",[87,88,90],"h2",{"id":89},"how-to-read-a-finding","How to read a finding",[14,92,93],{},"Whichever family it belongs to, a finding gives you three things.",[30,95,96,102,108],{},[33,97,98,101],{},[18,99,100],{},"The element (or flow) it concerns."," Every finding names the specific element, data flow, or boundary it fired on. In the report those names are clickable and take you straight to the element's risk profile.",[33,103,104,107],{},[18,105,106],{},"Its evidence."," A plain-language sentence stating the declared facts that triggered the finding — the route, the zone pair, the data class, the missing control. Zoning findings always phrase this as a statement about the model as drawn (\"the model declares a crossing the policy forbids\"), never as a claim that a live flow was observed and verified.",[33,109,110,113,114,117,118,117,121,117,124,127,128,131,132,85],{},[18,111,112],{},"Its severity band."," One of ",[18,115,116],{},"Critical",", ",[18,119,120],{},"High",[18,122,123],{},"Medium",[18,125,126],{},"Low",", or ",[18,129,130],{},"Unscored",", shown as an outlined chip. The band tells you how loud the finding is — not a probability, and not a monetary loss. The band vocabulary is defined in ",[68,133,84],{"href":134},"\u002Frisk-assessment\u002Freading-the-report#bands",[14,136,137],{},"The two families set their band differently, and deliberately so:",[30,139,140,146],{},[33,141,16,142,145],{},[18,143,144],{},"control-gap finding (F1–F5)"," takes its band from your data — it is the worst band among the exposures that triggered it. A finding that fired on a Critical exposure is Critical.",[33,147,16,148,151,152,155,156,159],{},[18,149,150],{},"zoning finding (F6–F10)"," takes a ",[18,153,154],{},"fixed band for its policy class"," — the severity of a forbidden crossing is a property of the ",[46,157,158],{},"policy",", not of any score. (The one exception is noted under F6.)",[161,162,164],"h3",{"id":163},"the-three-states-of-a-finding-type","The three states of a finding type",[14,166,167],{},"Each of the ten finding types reports one of three states, shown distinctly on its panel so you never have to guess which one you are looking at:",[30,169,170,176,186],{},[33,171,172,175],{},[18,173,174],{},"Instances found"," — the check ran and flagged one or more places (for example, \"3 found\"). Expand the panel to see each instance.",[33,177,178,181,182,185],{},[18,179,180],{},"Checked — none found"," — the check ran cleanly against the current model and flagged nothing. This is a ",[18,183,184],{},"positive result",": assurance that the condition was looked for and is not present.",[33,187,188,191,192],{},[18,189,190],{},"Not computable"," — the check could not run, and the panel states why (for example, no crown jewels are declared, there are no entry origins, or the model has no recognized zones). This is not the same as a clean pass. As the report puts it: ",[46,193,194],{},"absence of a result is not absence of risk.",[14,196,197],{},[198,199],"img",{"alt":200,"src":201},"The Findings tab listing all ten finding types in two groups — the five control-gap findings (F1–F5) and the five architectural \u002F data-flow findings (F6–F10) — each showing its code, name, and a state marker: an amber \"N found\" where something was found, or a cyan \"checked — none found\" where the check ran clean.","\u002Fguides\u002Frisk-assessment\u002Fimages\u002Ffindings-panel.png",[14,203,204],{},[46,205,206,207,210,211,214],{},"The Findings tab. Each finding type shows its code, name, and state marker on the right — an amber ",[18,208,209],{},"\"⚠ N found\""," when the check surfaced something, or a cyan ",[18,212,213],{},"\"✓ checked — none found\""," when it ran and found nothing. The two groups are the control-gap findings (F1–F5) and the architectural \u002F data-flow findings (F6–F10).",[87,216,71],{"id":217},"what-a-finding-is-and-is-not",[14,219,220],{},"The Risk Assessment is built to be the honest reading of your model, and the wording of every finding is constrained to keep it that way. Two rules matter when you interpret one:",[30,222,223,229],{},[33,224,225,228],{},[18,226,227],{},"A finding does not say your system is broken."," It says the model, as declared, contains a pattern worth examining. Whether it is a real gap, an accepted trade-off, or a modeling oversight is for you to decide.",[33,230,231,234,235,238,239,85],{},[18,232,233],{},"A nearby control is never counted as a fix."," Having guidance, or having a control somewhere in the vicinity, is not the same as moving a rating. If you add or reconfigure a control in response to a finding, that is a change to your model — you must ",[18,236,237],{},"re-run the analysis (Recreate)"," to see its effect. Until you do, the finding stands. The reasoning behind this is in ",[68,240,79],{"href":241},"\u002Frisk-assessment\u002Fmethodology-and-trust#no-green",[14,243,244,245,248,249,252,253,256,257,261,262,265],{},"Because of this, the actions a finding offers are always the same three shapes: ",[18,246,247],{},"investigate"," it, ",[18,250,251],{},"change the model"," (add or configure a control, or correct a zone declaration) and re-run, or ",[18,254,255],{},"accept it into the risk register"," as a tracked risk with an owner and a rationale. That last path is described in ",[68,258,260],{"href":259},"\u002Frisk-assessment\u002Fthe-risk-register","The Risk Register","; every finding in the report carries a ",[18,263,264],{},"+ risk"," action that seeds a register entry from the finding as evidence.",[58,267,268],{},[14,269,270,271,274,275,279,280,283],{},"Throughout this guide, a ",[18,272,273],{},"live"," exposure means one that has not been set aside by a decision (a ",[68,276,278],{"href":277},"\u002Frisk-assessment\u002Freading-the-report#dispositions","disposition","); a ",[18,281,282],{},"dispositioned"," finding — for example one you affirmed or accepted — is kept in the record but excluded from the running totals.",[87,285,287],{"id":286},"the-ten-findings-at-a-glance","The ten findings at a glance",[289,290,296],"div",{"className":291,"tabIndex":293,"role":294,"ariaLabel":295},[292],"table-frame",0,"region","Table: The ten findings at a glance",[297,298,299,315],"table",{},[300,301,302],"thead",{},[303,304,305,309,312],"tr",{},[306,307,308],"th",{},"Finding",[306,310,311],{},"Family",[306,313,314],{},"What it tells you",[316,317,318,332,344,356,368,380,393,405,417,429],"tbody",{},[303,319,320,326,329],{},[321,322,323],"td",{},[18,324,325],{},"F1 — Crown-jewel route without detection coverage",[321,327,328],{},"Control gap",[321,330,331],{},"A modeled route reaches a crown jewel, and no element along it has a detection control on its exposures' ATT&CK techniques.",[303,333,334,339,341],{},[321,335,336],{},[18,337,338],{},"F2 — Undominated choke point with live network exposure",[321,340,328],{},[321,342,343],{},"A choke point that all routes to a protected asset pass through carries a network-facing exposure and no control isolates its ATT&CK techniques.",[303,345,346,351,353],{},[321,347,348],{},[18,349,350],{},"F3 — Regulated\u002Fsensitive data on a zone-crossing flow",[321,352,328],{},[321,354,355],{},"A flow carrying regulated or sensitive data crosses a trust boundary with a live exposure and no detection or isolation on its ATT&CK techniques.",[303,357,358,363,365],{},[321,359,360],{},[18,361,362],{},"F4 — Stale risk acceptance on a crown-jewel route",[321,364,328],{},[321,366,367],{},"An element on a route to a crown jewel carries a previously accepted risk that may no longer be valid.",[303,369,370,375,377],{},[321,371,372],{},[18,373,374],{},"F5 — Entry-surface element with an empty mitigation chain",[321,376,328],{},[321,378,379],{},"An element on your entry surface has a live exposure and no control matched to its ATT&CK techniques.",[303,381,382,387,390],{},[321,383,384],{},[18,385,386],{},"F6 — Data-flow policy violation",[321,388,389],{},"Zoning",[321,391,392],{},"A modeled flow crosses between trust zones in a way the zoning policy forbids.",[303,394,395,400,402],{},[321,396,397],{},[18,398,399],{},"F7 — Conduit authorises an illegal crossing",[321,401,389],{},[321,403,404],{},"A conduit you declared would itself sanction a crossing the policy forbids.",[303,406,407,412,414],{},[321,408,409],{},[18,410,411],{},"F8 — Conduit governance — missing or review-worthy channel",[321,413,389],{},[321,415,416],{},"A permitted crossing lacks a declared conduit to authorize it, or is a sanctioned channel worth review.",[303,418,419,424,426],{},[321,420,421],{},[18,422,423],{},"F9 — Unusual data-flow path (advisory)",[321,425,389],{},[321,427,428],{},"A crossing that is allowed but unusual enough to confirm — for example, data leaving a restricted zone.",[303,430,431,436,438],{},[321,432,433],{},[18,434,435],{},"F10 — Boundary advisory — misplacement \u002F exposed management \u002F unclassified \u002F shared-domain coupling",[321,437,389],{},[321,439,440],{},"A boundary-level placement concern, judged per boundary rather than per flow.",[14,442,443],{},"The subsections below take each finding in turn, in the order the report presents them.",[87,445,37],{"id":446},"control-gap-findings-f1f5",[14,448,449],{},"These five look at the protections around your risks. They run over the same picture of your entry surface and the routes through your model that drives the report's likelihood ratings, so a finding and a rating can never disagree about where the exposed surface is.",[161,451,453],{"id":452},"f1-crown-jewel-route-without-detection-coverage","F1 · Crown-jewel route without detection coverage",[14,455,456,459],{},[18,457,458],{},"What it means."," There is a modeled flow route from your entry surface to a crown jewel, and not one element along that route carries a detection control against the relevant ATT&CK techniques. If something moved along that path, nothing on it is declared to detect those techniques.",[14,461,462,465],{},[18,463,464],{},"Why it appears."," You have marked an asset as a crown jewel; a modeled data flow reaches it from an entry origin; and none of the elements on that route declare a detection control against the ATT&CK techniques behind the route's exposures. The finding's band is the worst exposure encountered along the route.",[14,467,468,471],{},[18,469,470],{},"What to do."," Walk the route the finding names and decide whether detection is genuinely absent or simply unmodeled. If it is absent, add monitoring or detection to an element on the path and re-run the analysis. If the route is acceptable as-is, accept it into the risk register so the decision is recorded against an owner.",[161,473,475],{"id":474},"f2-undominated-choke-point-with-live-network-exposure","F2 · Undominated choke point with live network exposure",[14,477,478,480,481,484],{},[18,479,458],{}," A single component that ",[46,482,483],{},"every"," modeled route to a protected asset must pass through — a choke point — carries a live, network-facing exposure, and no control isolates its ATT&CK techniques. A choke point is the natural place to contain a threat; this one has no isolation declared against those techniques.",[14,486,487,489],{},[18,488,464],{}," The topology of your flows makes this component a choke point in front of one or more protected assets; it has a live exposure reachable over the network; and it declares no isolation control on its ATT&CK techniques. Because a choke point guards valuable assets, the finding's impact is lifted to the level of the most valuable asset behind it, so it is not buried beneath the component's own rating.",[14,491,492,494],{},[18,493,470],{}," Treat the choke point as a containment opportunity: consider isolation or segmentation, then re-run the analysis. If isolation is not feasible, accept the finding into the register.",[58,496,497],{},[14,498,499,502,503,506],{},[18,500,501],{},"A limitation to know."," This check considers components only. An isolation gap that lives on a data flow itself — rather than on a component — surfaces as ",[18,504,505],{},"F3",", not here. If you expect a choke-point finding and do not see one, check F3 for the same crossing.",[161,508,510],{"id":509},"f3-regulatedsensitive-data-on-a-zone-crossing-flow","F3 · Regulated\u002Fsensitive data on a zone-crossing flow",[14,512,513,515],{},[18,514,458],{}," A data flow that carries regulated or sensitive data crosses a trust boundary, carries a live exposure, and has neither a detection nor an isolation control on its exposures' ATT&CK techniques. Sensitive data is moving between zones with nothing declared to watch or contain those techniques on the crossing.",[14,517,518,520],{},[18,519,464],{}," The flow handles data you have marked as regulated or sensitive; its two endpoints sit in different declared zones; the flow carries a live exposure; and no detection or isolation control is declared against its exposures' ATT&CK techniques.",[14,522,523,525,526,529],{},[18,524,470],{}," Review the crossing: confirm the data classification, then add detection or isolation to the flow and re-run, or re-route the data. If the crossing is intended and governed elsewhere, accept it into the register. A flow that fires F3 will often also fire an architectural finding (F6, F8, or F9) on the same crossing; when it does, each finding notes the other with ",[46,527,528],{},"\"also fires … on this flow\""," so you can see the full picture from either side.",[161,531,533],{"id":532},"f4-stale-risk-acceptance-on-a-crown-jewel-route","F4 · Stale risk acceptance on a crown-jewel route",[14,535,536,538,539,542,543,546],{},[18,537,458],{}," An element on a route to a crown jewel carries a risk you previously ",[18,540,541],{},"accepted",", and that acceptance is now ",[18,544,545],{},"stale"," — the model has changed since the acceptance was recorded, so the decision may no longer reflect reality. This is the one finding that deliberately surfaces an already-accepted item, precisely because it sits on a sensitive route.",[14,548,549,551],{},[18,550,464],{}," You recorded a risk acceptance on the element; the model has since changed in a way that marks that acceptance stale; and the element lies on a modeled route to a crown jewel.",[14,553,554,556],{},[18,555,470],{}," Re-review the acceptance against the current model. Re-affirm it if it still holds, update its rationale, or record a fresh decision. Because the item is already in your disposition history, the goal here is to keep that history honest rather than to add a control.",[161,558,560],{"id":559},"f5-entry-surface-element-with-an-empty-mitigation-chain","F5 · Entry-surface element with an empty mitigation chain",[14,562,563,565,566,569,570,573],{},[18,564,458],{}," An element on your ",[18,567,568],{},"entry surface"," — a component an attacker could reach first, because it faces an untrusted or public zone or is an external entry point — has a live exposure and ",[18,571,572],{},"no control matched to its ATT&CK techniques",". The first thing an attacker meets has no matched control in front of those techniques.",[14,575,576,578],{},[18,577,464],{}," The element is an entry origin; it carries a live exposure; and no control at any level matches that exposure's ATT&CK techniques. The finding's band is the worst such bare exposure on the element.",[14,580,581,583],{},[18,582,470],{}," This is usually the highest-value place to add a control. Introduce a mitigating control against the exposure and re-run the analysis, or accept the exposure into the register if it is a known and owned trade-off.",[14,585,586],{},[68,587],{"id":588},"zoning",[87,590,592],{"id":591},"architectural-and-data-flow-zoning-findings-f6f10","Architectural and data-flow (zoning) findings (F6–F10)",[14,594,595,596,599,600,603,604,606,607,610,611,614,615,618,619,622],{},"These five judge the ",[18,597,598],{},"flows between your trust zones"," against the zoning policy your model expresses. They rest on one principle: ",[18,601,602],{},"the zones you declare are authoritative."," The Risk Assessment never re-classifies a boundary you have zoned — a link between two zones is a ",[46,605,158],{}," question, not a re-rating. Consequently every zoning finding describes the model ",[18,608,609],{},"as drawn",": it means ",[46,612,613],{},"\"the model, as declared, encodes this crossing\"",", never ",[46,616,617],{},"\"we verified this flow can occur.\""," Where a zone was filled in by policy default rather than declared by you, the report marks it ",[18,620,621],{},"(defaulted)"," so you can tell the difference.",[14,624,625,626,629,630,117,633,117,636,127,639,642,643,85],{},"The report also shows a single ",[18,627,628],{},"Data-flow policy"," line summarizing this family — ",[46,631,632],{},"passes",[46,634,635],{},"passes with warnings\u002Fadvisories",[46,637,638],{},"fails",[46,640,641],{},"not evaluated",". That rollup and how to read it live in ",[68,644,84],{"href":83},[161,646,648],{"id":647},"f6-data-flow-policy-violation","F6 · Data-flow policy violation",[14,650,651,653,654,657],{},[18,652,458],{}," A modeled flow crosses between two trust zones in a way the zoning policy ",[18,655,656],{},"forbids"," — for example, a flow that skips a trust tier, or a cross-domain flow into a restricted zone.",[14,659,660,662],{},[18,661,464],{}," The declared zones of the flow's two endpoints, together with the direction of the crossing and the domains involved, match a pattern the policy classifies as a violation.",[14,664,665,667],{},[18,666,470],{}," Re-examine the architecture. If the zones are mislabeled, correct them and re-run. If the crossing is real, redesign the flow or route it through a sanctioned conduit. If it is a deliberate exception, accept it into the register.",[58,669,670],{},[14,671,672,675,676,678,679,681],{},[18,673,674],{},"Severity."," F6 is ",[18,677,120],{},", raised to ",[18,680,116],{}," when one of the two boundaries directly holds a crown jewel or another critical-impact asset — a forbidden crossing that touches your most valuable assets is the loudest thing this family can say.",[161,683,685],{"id":684},"f7-conduit-authorises-an-illegal-crossing","F7 · Conduit authorises an illegal crossing",[14,687,688,690,691,694],{},[18,689,458],{}," A ",[18,692,693],{},"conduit"," you declared — a sanctioned channel between zones — would itself authorize a crossing the policy forbids. The problem is the authorizing channel, judged on its own endpoints before any flow uses it.",[14,696,697,699,700,85],{},[18,698,464],{}," The conduit's two endpoints, by their declared zones, form a crossing the policy classifies as illegal. The conduit is inspected in its own right, so this fires even if no flow currently travels through it. Its band is ",[18,701,120],{},[14,703,704,706],{},[18,705,470],{}," Review the conduit. Remove it, narrow its endpoints, or correct the zone declarations it connects, then re-run. If the channel is intended, accept the finding into the register with your justification.",[161,708,710],{"id":709},"f8-conduit-governance-missing-or-review-worthy-channel","F8 · Conduit governance — missing or review-worthy channel",[14,712,713,715,716,719],{},[18,714,458],{}," A crossing the policy ",[18,717,718],{},"permits in principle"," is either not authorized by any declared conduit, or is a sanctioned channel worth a second look. This is a governance nudge rather than a violation.",[14,721,722,724,725,728,729,731],{},[18,723,464],{}," The crossing is allowed by the trust gradient, but no declared conduit covers it — a ",[18,726,727],{},"missing channel (Medium)"," — or it is a sanctioned outbound (egress) or management-plane crossing that the policy surfaces for review (",[18,730,126],{},").",[14,733,734,736],{},[18,735,470],{}," For a missing channel, declare the conduit that governs the crossing so your model records the intent, then re-run. For a review-worthy channel, confirm it is expected. Either way, accept it into the register if you want the decision tracked.",[161,738,740],{"id":739},"f9-unusual-data-flow-path-advisory","F9 · Unusual data-flow path (advisory)",[14,742,743,745,746,749],{},[18,744,458],{}," A crossing that is ",[18,747,748],{},"not forbidden"," but is unusual enough to be worth confirming — for example, data leaving a restricted zone, or a control-plane flow reaching into a restricted zone.",[14,751,752,754,755,85],{},[18,753,464],{}," The crossing matches an advisory pattern in the policy: allowed, but atypical. Its band is ",[18,756,126],{},[14,758,759,761],{},[18,760,470],{}," Confirm the flow is intended. If it is, no change is needed; you may accept it into the register to note that it was reviewed. If it is not, correct the flow or the zones.",[161,763,765],{"id":764},"f10-boundary-advisory-misplacement-exposed-management-unclassified-shared-domain-coupling","F10 · Boundary advisory — misplacement \u002F exposed management \u002F unclassified \u002F shared-domain coupling",[14,767,768,770,771,774],{},[18,769,458],{}," A concern about the ",[18,772,773],{},"placement of a boundary itself",", rather than about any single flow. F10 is computed per boundary and covers four distinct situations, each with its own severity:",[30,776,777,783,789,795],{},[33,778,779,782],{},[18,780,781],{},"Under-protected asset (Critical)"," — a declared crown jewel sits directly in an exposed zone, with nothing between it and the outside.",[33,784,785,788],{},[18,786,787],{},"Exposed management plane (Medium)"," — a management plane is declared in a public or exposed zone, where administrative access should not live.",[33,790,791,794],{},[18,792,793],{},"Unclassified boundary (Unscored)"," — a boundary that holds assets but declares no recognized zone anywhere in its ancestry, so the policy cannot reason about its flows.",[33,796,797,800],{},[18,798,799],{},"Shared-domain coupling (Low)"," — a declared domain tag couples a protected boundary with an externally reachable one, blurring a separation you have otherwise drawn.",[14,802,803,805],{},[18,804,464],{}," Each sub-kind reads directly from your declarations: the placement of a crown jewel, the plane and zone of a boundary, the absence of a zone, or a domain tag shared across a trust divide. The shared-domain check depends on your model declaring domain tags; where it does not, that dimension is simply not evaluated.",[14,807,808,810,811,814],{},[18,809,470],{}," The remedy follows the sub-kind: move the crown jewel to a more protected zone; move management access off the exposed zone; ",[18,812,813],{},"classify the boundary"," by declaring its zone (an unclassified boundary is a modeling gap, not a clean result); or review the shared-domain coupling. Re-run the analysis after any model change, or accept the item into the register.",[58,816,817],{},[14,818,819,822,823,826],{},[18,820,821],{},"When this family cannot run."," Zoning analysis needs boundaries and recognized zones to reason about. On a model with none, the whole family reports ",[18,824,825],{},"not computable"," with that reason, rather than a misleading clean pass.",[87,828,830],{"id":829},"turning-a-finding-into-a-tracked-risk","Turning a finding into a tracked risk",[14,832,833,834,837,838,840,841,843,844,848],{},"Investigating a finding and changing the model are the fast paths, but many findings should also become ",[18,835,836],{},"tracked risks"," — owned, rated, and reviewed on a cadence — whether or not you fix them immediately. Every finding in the report offers a ",[18,839,264],{}," action that opens a new register entry pre-filled with the finding as its evidence, so the link between the observation and the decision is preserved. See ",[68,842,260],{"href":259}," for how to author a risk, cite a finding as evidence, and keep that evidence ",[68,845,847],{"href":846},"\u002Frisk-assessment\u002Fthe-risk-register#evidence-liveness","in step with the model"," as it changes.",[87,850,852],{"id":851},"related-guides","Related guides",[30,854,855,860,865,870,877],{},[33,856,857,859],{},[68,858,84],{"href":83}," — how to scan the Findings surface, read the assurance states, and drill into the elements a finding names.",[33,861,862,864],{},[68,863,260],{"href":259}," — turning a finding into a tracked risk and citing it as evidence.",[33,866,867,869],{},[68,868,79],{"href":78}," — why findings are worded the way they are, and what the bands and states do and do not claim.",[33,871,872,876],{},[68,873,875],{"href":874},"\u002Frisk-assessment\u002Fstakeholder-reports","Stakeholder Reports"," — how findings appear in exported reports for different audiences.",[33,878,879,883,884,883,888],{},[68,880,882],{"href":881},"\u002Frisk-assessment\u002Fgetting-started","Getting Started"," · ",[68,885,887],{"href":886},"\u002Frisk-assessment","Overview",[68,889,891],{"href":890},"\u002Frisk-assessment\u002Ffaq","FAQ",{"title":893,"searchDepth":894,"depth":894,"links":895},"",3,[896,900,901,902,909,916,917],{"id":89,"depth":897,"text":90,"children":898},2,[899],{"id":163,"depth":894,"text":164},{"id":217,"depth":897,"text":71},{"id":286,"depth":897,"text":287},{"id":446,"depth":897,"text":37,"children":903},[904,905,906,907,908],{"id":452,"depth":894,"text":453},{"id":474,"depth":894,"text":475},{"id":509,"depth":894,"text":510},{"id":532,"depth":894,"text":533},{"id":559,"depth":894,"text":560},{"id":591,"depth":897,"text":592,"children":910},[911,912,913,914,915],{"id":647,"depth":894,"text":648},{"id":684,"depth":894,"text":685},{"id":709,"depth":894,"text":710},{"id":739,"depth":894,"text":740},{"id":764,"depth":894,"text":765},{"id":829,"depth":897,"text":830},{"id":851,"depth":897,"text":852},"A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.","md",{},true,"\u002Frisk-assessment\u002Ffindings",{"title":5,"description":918},"05.risk-assessment\u002F02.findings","T4D47k1jsWqqb6ZreogC04fN3HgFBfJwRKX1ce_P5J4",[927,982,1017,1072,1105,1136,1151,1221],{"title":928,"description":929,"path":930,"stem":931,"children":932,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[933,937,942,947,952,957,962,967,972,977],{"title":934,"path":930,"stem":935,"description":936},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":938,"path":939,"stem":940,"description":941},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":943,"path":944,"stem":945,"description":946},"Building Your First Model","\u002Fplatform\u002Fbuilding-your-first-model","01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":948,"path":949,"stem":950,"description":951},"Security Analysis Workflow","\u002Fplatform\u002Fsecurity-analysis-workflow","01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":953,"path":954,"stem":955,"description":956},"Managing Findings","\u002Fplatform\u002Fmanaging-findings","01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":958,"path":959,"stem":960,"description":961},"Working with Security Controls","\u002Fplatform\u002Fworking-with-security-controls","01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":963,"path":964,"stem":965,"description":966},"Issue Management Guide","\u002Fplatform\u002Fissue-management-guide","01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":968,"path":969,"stem":970,"description":971},"Boundary Trust Zones","\u002Fplatform\u002Fboundary-trust-zones","01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":973,"path":974,"stem":975,"description":976},"Understanding Modules","\u002Fplatform\u002Funderstanding-modules","01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":978,"path":979,"stem":980,"description":981},"Component Configuration Guide","\u002Fplatform\u002Fcomponent-configuration-guide","01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":983,"description":984,"path":985,"stem":986,"children":987,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[988,992,997,1002,1007,1012],{"title":989,"path":985,"stem":990,"description":991},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":993,"path":994,"stem":995,"description":996},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":998,"path":999,"stem":1000,"description":1001},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":1003,"path":1004,"stem":1005,"description":1006},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":1008,"path":1009,"stem":1010,"description":1011},"Connecting the BYODt Deployment to the Cloud","\u002Fbyodt-cloud\u002Fcloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":1013,"path":1014,"stem":1015,"description":1016},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":1018,"description":1019,"path":1020,"stem":1021,"children":1022,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[1023,1027,1032,1037,1042,1047,1052,1057,1062,1067],{"title":1024,"path":1020,"stem":1025,"description":1026},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":1028,"path":1029,"stem":1030,"description":1031},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":1033,"path":1034,"stem":1035,"description":1036},"The 11-Step Guided Workflow","\u002Fdethereal\u002Fguided-workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":1038,"path":1039,"stem":1040,"description":1041},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":1043,"path":1044,"stem":1045,"description":1046},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":1048,"path":1049,"stem":1050,"description":1051},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":1053,"path":1054,"stem":1055,"description":1056},"Sync and Version Control","\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":1058,"path":1059,"stem":1060,"description":1061},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":1063,"path":1064,"stem":1065,"description":1066},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":1068,"path":1069,"stem":1070,"description":1071},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":1073,"description":1074,"path":1075,"stem":1076,"children":1077,"page":-1},"Threat Report","The residual-risk report over a threat model: reading it, filtering it and exporting it.","\u002Fthreat-report","04.threat-report",[1078,1081,1086,1090,1095,1100],{"title":1073,"path":1075,"stem":1079,"description":1080},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":1082,"path":1083,"stem":1084,"description":1085},"Getting Started with the Threat Report","\u002Fthreat-report\u002Fgetting-started","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":84,"path":1087,"stem":1088,"description":1089},"\u002Fthreat-report\u002Freading-the-report","04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":1091,"path":1092,"stem":1093,"description":1094},"Understanding Coverage and Gaps","\u002Fthreat-report\u002Funderstanding-coverage","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":1096,"path":1097,"stem":1098,"description":1099},"Reachability and Flow Routes","\u002Fthreat-report\u002Freachability","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":1101,"path":1102,"stem":1103,"description":1104},"Working with Findings","\u002Fthreat-report\u002Fworking-with-findings","04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":1106,"description":1107,"path":886,"stem":1108,"children":1109,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","05.risk-assessment",[1110,1114,1118,1119,1122,1125,1129,1133],{"title":1111,"path":886,"stem":1112,"description":1113},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":1115,"path":890,"stem":1116,"description":1117},"FAQ and Troubleshooting","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":5,"path":922,"stem":924,"description":918},{"title":882,"path":881,"stem":1120,"description":1121},"05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":79,"path":78,"stem":1123,"description":1124},"05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":84,"path":1126,"stem":1127,"description":1128},"\u002Frisk-assessment\u002Freading-the-report","05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":1130,"path":874,"stem":1131,"description":1132},"Stakeholder Reports and Exports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":260,"path":259,"stem":1134,"description":1135},"05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":1137,"description":1138,"path":1139,"stem":1140,"children":1141,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[1142,1146],{"title":1143,"path":1139,"stem":1144,"description":1145},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":1147,"path":1148,"stem":1149,"description":1150},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":1152,"description":1153,"path":1154,"stem":1155,"children":1156,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","\u002Fagentic-modelling","07.agentic-modelling",[1157,1161,1166,1171,1176,1181,1186,1191,1196,1201,1206,1211,1216],{"title":1158,"path":1154,"stem":1159,"description":1160},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":1162,"path":1163,"stem":1164,"description":1165},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":1167,"path":1168,"stem":1169,"description":1170},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":1172,"path":1173,"stem":1174,"description":1175},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":1177,"path":1178,"stem":1179,"description":1180},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":1182,"path":1183,"stem":1184,"description":1185},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":1187,"path":1188,"stem":1189,"description":1190},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":1192,"path":1193,"stem":1194,"description":1195},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":1197,"path":1198,"stem":1199,"description":1200},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":1202,"path":1203,"stem":1204,"description":1205},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":1207,"path":1208,"stem":1209,"description":1210},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":1212,"path":1213,"stem":1214,"description":1215},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":1217,"path":1218,"stem":1219,"description":1220},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":1222,"description":1223,"path":1224,"stem":1225,"children":1226,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[1227,1231,1236],{"title":1228,"path":1224,"stem":1229,"description":1230},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":1232,"path":1233,"stem":1234,"description":1235},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":1237,"path":1238,"stem":1239,"description":1240},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748186053]