[{"data":1,"prerenderedAt":1382},["ShallowReactive",2],{"page-\u002Frisk-assessment\u002Freading-the-report":3,"navigation":1068},{"id":4,"title":5,"body":6,"description":16,"extension":1061,"meta":1062,"navigation":1063,"path":1064,"seo":1065,"stem":1066,"__hash__":1067},"docs\u002F05.risk-assessment\u002F05.reading-the-report.md","Reading the Report",{"type":7,"value":8,"toc":1039},"minimark",[9,13,17,33,48,56,61,64,178,181,185,192,234,249,256,265,270,287,293,301,305,330,347,351,354,397,404,408,423,428,432,438,445,448,497,503,506,512,516,522,527,534,538,543,561,571,576,580,586,659,662,715,728,732,738,838,843,847,872,879,884,888,897,920,925,930,934,947,988,995,999],[10,11,5],"h1",{"id":12},"reading-the-report",[14,15,16],"p",{},"The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",[14,18,19,20,24,25,28,29,32],{},"The report is deliberately conservative. Every value on screen is a ",[21,22,23],"strong",{},"band"," (a relative rating), a ",[21,26,27],{},"count",", or a ",[21,30,31],{},"count with a denominator"," — traceable to your own model. There is no single \"risk score\", and there is no flattering aggregate that rolls everything up into one reassuring number. When the report cannot assess something, it shows you that gap rather than hiding it.",[34,35,36],"blockquote",{},[14,37,38,41,42,47],{},[21,39,40],{},"Before you start."," This guide assumes a report has already been generated for your model. If you have not generated one yet, see ",[43,44,46],"a",{"href":45},"\u002Frisk-assessment\u002Fgetting-started","Getting Started",".",[14,49,50,53],{},[43,51],{"id":52},"executive-band",[43,54],{"id":55},"staleness",[57,58,60],"h2",{"id":59},"how-the-report-is-laid-out","How the report is laid out",[14,62,63],{},"A generated report has three stacked regions, read top to bottom:",[65,66,72],"div",{"className":67,"tabIndex":69,"role":70,"ariaLabel":71},[68],"table-frame",0,"region","Table: How the report is laid out",[73,74,75,88],"table",{},[76,77,78],"thead",{},[79,80,81,85],"tr",{},[82,83,84],"th",{},"Region",[82,86,87],{},"What it is",[89,90,91,122,148],"tbody",{},[79,92,93,99],{},[94,95,96],"td",{},[21,97,98],{},"Freshness header",[94,100,101,102,106,107,110,111,114,115,117,118,47],{},"A line reading ",[103,104,105],"em",{},"\"Reflects the model as of \u003Cdate>\""," and the ",[21,108,109],{},"Recreate"," button. If your model has changed since the report was generated, an amber ",[103,112,113],{},"\"model changed\""," notice appears here — a signal that a number below may be out of date. Regenerating is covered in ",[43,116,46],{"href":45},"; what \"stale\" means in detail is in ",[43,119,121],{"href":120},"\u002Frisk-assessment\u002Fmethodology-and-trust","Methodology and Trust",[79,123,124,129],{},[94,125,126],{},[21,127,128],{},"Executive band",[94,130,131,132,135,136,139,140,143,144,147],{},"The one-glance summary: the risk ",[21,133,134],{},"matrix",", the ",[21,137,138],{},"Coverage posture"," strip, the ",[21,141,142],{},"Takeaway"," line, and a ",[21,145,146],{},"flags"," row. Designed so a screenshot of it stands on its own.",[79,149,150,155],{},[94,151,152],{},[21,153,154],{},"Analytical tabs",[94,156,157,158,161,162,161,165,161,168,161,171,161,174,177],{},"Six tabs — ",[21,159,160],{},"Priorities",", ",[21,163,164],{},"Findings",[21,166,167],{},"Distributions",[21,169,170],{},"Ledger",[21,172,173],{},"Register",[21,175,176],{},"Methodology"," — for working through the detail.",[14,179,180],{},"The rest of this guide walks the executive band first, then explains severity bands, then the tabs.",[57,182,184],{"id":183},"the-risk-matrix","The risk matrix",[14,186,187,188,191],{},"The matrix is the report's headline. It is titled ",[21,189,190],{},"INHERENT EXPOSURE POSITION — as of \u003Cdate>",", and it plots your model's elements on two axes:",[193,194,195,211],"ul",{},[196,197,198,201,202,161,205,161,208,47],"li",{},[21,199,200],{},"Rows — likelihood",", loudest at the top: ",[21,203,204],{},"Exposed",[21,206,207],{},"Reachable",[21,209,210],{},"Internal",[196,212,213,216,217,161,220,161,223,161,226,229,230,233],{},[21,214,215],{},"Columns — impact",", ascending: ",[21,218,219],{},"Low",[21,221,222],{},"Medium",[21,224,225],{},"High",[21,227,228],{},"Critical",", and ",[21,231,232],{},"Unrated"," set off at the end.",[14,235,236,237,240,241,245,246,47],{},"Each cell shows a ",[21,238,239],{},"count of elements"," that sit at that likelihood\u002Fimpact position. An empty cell shows a faint dot (",[242,243,244],"code",{},"·","), never a bold ",[242,247,248],{},"0",[14,250,251],{},[252,253],"img",{"alt":254,"src":255},"The likelihood by impact matrix: rows are likelihood (Exposed, Reachable, Internal, loudest at the top); columns are impact (Low, Medium, High, Critical, then an Unrated column set off at the end). Each cell shows a count of elements at that position, or a faint dot when empty. The top-right (Exposed by Critical) is the most acute position; the bottom-left (Internal by Low) is the quietest. Cells are monochrome outlines — colour never encodes severity.","\u002Fguides\u002Frisk-assessment\u002Fimages\u002Frisk-matrix-explained.svg",[14,257,258],{},[103,259,260,261,264],{},"Reading a cell: pair the row (likelihood) with the column (impact). \"Three elements are Exposed and Critical\" (top-right) is a far sharper statement than \"three elements are Internal and Low\", even though both cells read ",[242,262,263],{},"3",". The Unrated column holds elements whose impact you have not yet set.",[266,267,269],"h3",{"id":268},"how-to-read-a-cell","How to read a cell",[14,271,272,273,276,277,280,281,284,285,47],{},"Position encodes severity. The ",[21,274,275],{},"top-right"," corner (Exposed × Critical) is the most acute place an element can sit; the ",[21,278,279],{},"bottom-left"," (Internal × Low) is the quietest. The number in the cell tells you ",[103,282,283],{},"how many"," elements are there. Read the two together: \"three elements are Exposed and Critical\" is a very different sentence from \"three elements are Internal and Low\", even though both cells show ",[242,286,263],{},[14,288,289,292],{},[21,290,291],{},"The matrix is monochrome on purpose."," It is not a green-to-red heatmap. Cells are plain outlined counts with no colour fill, and the axis labels carry all of the meaning. This is deliberate:",[193,294,295,298],{},[196,296,297],{},"Colour never does the work, so a greyscale printout, a projector, or a colour-blind reader loses nothing — the label and position still say everything.",[196,299,300],{},"There is no \"green = safe\" cell anyone can point at. The report will not let a risk be painted comfortable.",[266,302,304],{"id":303},"what-inherent-means","What \"inherent\" means",[14,306,307,308,311,312,315,316,319,320,322,323,326,327,329],{},"The matrix shows the ",[21,309,310],{},"inherent"," position — where an element sits ",[103,313,314],{},"before"," you credit any controls. Controls and mitigations do not move a cell. The caption states this directly: ",[103,317,318],{},"\"controls don't move these cells.\""," What controls do move — the residual, after-controls picture — is stated separately in the ",[21,321,138],{}," strip and in the ",[21,324,325],{},"Residual"," column on the ",[21,328,160],{}," tab.",[14,331,332,333,336,337,340,341,343,344,346],{},"Likelihood here — ",[21,334,335],{},"Exposed \u002F Reachable \u002F Internal"," — describes ",[103,338,339],{},"where an element sits in your modeled data flows and how it can be reached",", not how much effort an attacker would need. An \"Exposed\" element is one your model shows reachable from an outside entry point; it is a statement about topology, not about attacker skill. Impact — ",[21,342,219],{}," through ",[21,345,228],{}," — is an ordinal proxy built from the sensitivity of the data an element handles, any regulatory flags on that data, and whether you flagged the element as a crown-jewel (critical) asset. It is never a probability or a monetary loss figure.",[266,348,350],{"id":349},"the-unrated-column-the-tray-and-the-reconciliation-line","The Unrated column, the tray, and the reconciliation line",[14,352,353],{},"The matrix is honest about elements it cannot fully place:",[193,355,356,369,387],{},[196,357,358,361,362,364,365,368],{},[21,359,360],{},"Unrated column."," An element with no declared impact signal lands in ",[21,363,232],{},", marked with an information icon. Unrated means ",[103,366,367],{},"\"no impact signal was declared — a modeling gap, not low impact.\""," It is a prompt to enrich your model, not a reassurance.",[196,370,371,374,375,378,379,382,383,386],{},[21,372,373],{},"The tray."," Below the grid, an ",[103,376,377],{},"\"N insufficient-data (tray)\""," line collects elements whose findings are all unscored — ",[103,380,381],{},"\"not yet assessable\"",". Click ",[21,384,385],{},"view"," to list them. These are held out of the grid rather than parked in a misleading cell.",[196,388,389,392,393,396],{},[21,390,391],{},"The reconciliation line."," A muted line under the matrix reads, for example, ",[103,394,395],{},"\"40 elements: 24 placed · 6 insufficient-data (tray) · 10 no live findings.\""," The pieces always add back up to the total, so nothing quietly disappears.",[14,398,399,400,403],{},"If your model has no outside entry points, likelihood cannot be assessed at all. The matrix then shows ",[103,401,402],{},"\"Likelihood not assessable — no entry origins\""," and collapses to a single impact-only row. This is a visible, explained degradation — not a blank space.",[266,405,407],{"id":406},"drilling-into-a-cell","Drilling into a cell",[14,409,410,411,414,415,418,419,422],{},"Click any populated cell (or focus it and press ",[21,412,413],{},"Enter","; arrow keys move between cells) to open a side drawer listing every element in that cell. The drawer header restates both numbers honestly — for example ",[103,416,417],{},"\"12 elements · 18 contributing live findings — Exposed \u002F Critical-impact\""," — because the cell counts ",[103,420,421],{},"elements"," while the drawer lists them and shows the findings behind them. From the drawer, click an element name to open its full risk profile. Search narrows the list for busy cells.",[14,424,425],{},[43,426],{"id":427},"coverage",[57,429,431],{"id":430},"the-coverage-posture-strip","The Coverage posture strip",[14,433,434,435,437],{},"Beside or below the matrix sits the ",[21,436,138],{}," strip — the after-controls view, stated as plain counts. It reads as one sentence, for example:",[34,439,440],{},[14,441,442,444],{},[21,443,138],{}," — 4\u002F11 top-band covered · 3 partially covered · 4 uncovered · 2 coverage unknown · 3 of the uncovered are Exposed",[14,446,447],{},"Read it carefully, because the design is the message:",[193,449,450,456,462,491],{},[196,451,452,455],{},[21,453,454],{},"It is a count with a denominator, never a percentage."," \"4\u002F11 covered\" tells you both the numerator and the population it is measured against. The report never shows a single, flattering \"covered %\" that would hide how many findings are in scope.",[196,457,458,461],{},[21,459,460],{},"The population is your High and Critical findings"," — the \"top band\". Everything in the strip is measured against that same denominator, so the numbers reconcile.",[196,463,464,467,468,471,472,475,476,479,480,483,484,487,488],{},[21,465,466],{},"There are four states, and they are kept separate."," ",[103,469,470],{},"Covered"," means a control clears the effectiveness bar for that finding. ",[103,473,474],{},"Partially covered"," means a control is present but does not reach full coverage. ",[103,477,478],{},"Uncovered"," means no control matched its ATT&CK techniques. ",[103,481,482],{},"Coverage unknown"," means the report could not decide — the finding lacks the ATT&CK technique references coverage is judged against, which is itself a modeling gap you can close. The report never folds \"partially covered\" or \"coverage unknown\" into \"uncovered\": ",[103,485,486],{},"\"we cannot tell\""," is never reported as ",[103,489,490],{},"\"confirmed gap.\"",[196,492,493,496],{},[21,494,495],{},"\"N of the uncovered are Exposed\""," is the sharpest number here — confirmed gaps that also sit at the Exposed likelihood tier.",[14,498,499,500,502],{},"Every number in the strip is a live link: click it to jump to the ",[21,501,170],{}," tab filtered to exactly those findings.",[14,504,505],{},"If some \"partially covered\" findings rest on a broader, family-level control match rather than one aimed at the exact technique, a small note beneath the strip discloses how many — so the composition of that count survives up here where a reader is likely to stop, rather than only three clicks down.",[14,507,508,509],{},"When there are no High or Critical findings in scope, the strip says so plainly: ",[103,510,511],{},"\"No top-band (High\u002FCritical) findings in scope.\"",[57,513,515],{"id":514},"the-takeaway-line","The Takeaway line",[14,517,518,519,521],{},"The ",[21,520,142],{}," is a single, deterministic sentence assembled from the counts already shown above — never a new number, never a verdict. It is written so it can travel verbatim into board minutes. Directly beneath it, a scope note keeps it honest:",[34,523,524],{},[14,525,526],{},"Scope: relative prioritization and coverage posture — not a calibrated risk score or loss estimate.",[14,528,529,530,533],{},"Read the Takeaway as a summary of ",[103,531,532],{},"where to look first",", not as a grade of your overall risk.",[57,535,537],{"id":536},"the-flags-row","The flags row",[14,539,518,540,542],{},[21,541,146],{}," row is the report's trust zone, and it puts the cautionary information first, before any reassuring number.",[14,544,545,548,549,552,553,556,557,560],{},[21,546,547],{},"Uncertainty \u002F conservatism flags (amber)."," If someone has tuned the assessment in a way that makes it ",[103,550,551],{},"less"," conservative — for example lowering the bar at which a finding counts as \"covered\", or softening how a data class maps to impact — that change is called out here by name, with its direction and who set it. For example: ",[103,554,555],{},"\"Control-mitigated threshold lowered to 6.0 — more findings count as covered than at the default 7.0 (set by …).\""," These flags warn you that the report may ",[21,558,559],{},"over-claim"," relative to its defaults. Read them before you read the numbers they affect. When nothing has been tuned, this amber block does not appear.",[14,562,563,566,567,570],{},[21,564,565],{},"Provenance line (neutral)."," Below the flags, a muted line states the report's basic accounting: how many findings were set aside by a decision (see the Ledger), how many elements and live findings are in scope, and the as-of date — for example ",[103,568,569],{},"\"6 dispositioned findings excluded · 40 elements · 118 live findings · as of \u003Cdate>.\""," The excluded-findings count links to the Ledger filtered to those set-aside rows, so nothing is hidden — only excluded from the running totals, with its state intact.",[14,572,573],{},[43,574],{"id":575},"bands",[57,577,579],{"id":578},"severity-bands","Severity bands",[14,581,582,583,585],{},"Everywhere the report rates something, it uses a ",[21,584,23],{},", not a number. The vocabulary is fixed:",[65,587,590],{"className":588,"tabIndex":69,"role":70,"ariaLabel":589},[68],"Table: Severity bands",[73,591,592,602],{},[76,593,594],{},[79,595,596,599],{},[82,597,598],{},"Band",[82,600,601],{},"Meaning",[89,603,604,613,622,631,640,650],{},[79,605,606,610],{},[94,607,608],{},[21,609,228],{},[94,611,612],{},"The most severe rating.",[79,614,615,619],{},[94,616,617],{},[21,618,225],{},[94,620,621],{},"Severe.",[79,623,624,628],{},[94,625,626],{},[21,627,222],{},[94,629,630],{},"Moderate.",[79,632,633,637],{},[94,634,635],{},[21,636,219],{},[94,638,639],{},"Least severe rating that still represents a finding.",[79,641,642,647],{},[94,643,644],{},[21,645,646],{},"Unscored",[94,648,649],{},"A finding with no usable score — assessed but not rateable.",[79,651,652,656],{},[94,653,654],{},[21,655,232],{},[94,657,658],{},"No impact signal was declared for the element — a modeling gap, not \"low\".",[14,660,661],{},"Three things are worth internalising:",[193,663,664,674,692],{},[196,665,666,669,670,673],{},[21,667,668],{},"A band is relative, not absolute."," It is an ordinal rating that places findings ",[103,671,672],{},"in order against each other",", drawn from a fixed, published qualitative scale. It is not a calibrated 0–10 score, and the report never exposes one.",[196,675,676,679,680,683,684,687,688,47],{},[21,677,678],{},"Band chips are outlined, never filled, and the word always carries the meaning."," Colour is redundant reinforcement only. A chip drawn with a dashed border and an ",[21,681,682],{},"authored"," tag marks a rating a ",[103,685,686],{},"person"," assigned in the register, rather than one the report computed — see ",[43,689,691],{"href":690},"\u002Frisk-assessment\u002Fthe-risk-register","The Risk Register",[196,693,694,467,697,699,700,702,703,706,707,710,711,714],{},[21,695,696],{},"\"Not assessed\" is shown, not hidden.",[21,698,646],{}," findings, ",[21,701,232],{}," impact, ",[103,704,705],{},"coverage unknown",", the matrix ",[21,708,709],{},"tray",", and finding types marked ",[103,712,713],{},"\"not computable\""," are all displayed as their own honest states. The report never quietly promotes an unknown into a clean result or a confirmed gap.",[14,716,717,718,720,721,723,724,727],{},"You will also see a ",[21,719,325],{}," band alongside the inherent ",[21,722,598],{}," on the Priorities tab. Residual is the rating ",[103,725,726],{},"after"," an effective control is credited — stepped down by at most one level from the inherent band. It is how the report shows a control helping without ever letting a control erase a risk entirely.",[57,729,731],{"id":730},"the-analytical-tabs","The analytical tabs",[14,733,734,735,737],{},"Below the executive band, six tabs let you work through the detail. ",[21,736,160],{}," is the default landing tab. Switching tabs keeps any filters you have applied.",[65,739,742],{"className":740,"tabIndex":69,"role":70,"ariaLabel":741},[68],"Table: The analytical tabs",[73,743,744,757],{},[76,745,746],{},[79,747,748,751,754],{},[82,749,750],{},"Tab",[82,752,753],{},"What it shows",[82,755,756],{},"How to read it",[89,758,759,771,786,798,810,824],{},[79,760,761,765,768],{},[94,762,763],{},[21,764,160],{},[94,766,767],{},"A ranked worklist of the elements that most need attention.",[94,769,770],{},"The order is the message — see below.",[79,772,773,777,780],{},[94,774,775],{},[21,776,164],{},[94,778,779],{},"The ten finding types, in two groups, each with an assurance state.",[94,781,782,783,47],{},"Scan the panel headers first — see below. Full catalogue in ",[43,784,164],{"href":785},"\u002Frisk-assessment\u002Ffindings",[79,787,788,792,795],{},[94,789,790],{},[21,791,167],{},[94,793,794],{},"A model-wide band bar and a boundary-by-zone heatmap of where risk sits.",[94,796,797],{},"Counts are elements, coloured by their worst band (text only). Use the severity lens to filter.",[79,799,800,804,807],{},[94,801,802],{},[21,803,170],{},[94,805,806],{},"Every finding in one searchable table — the place to record decisions.",[94,808,809],{},"Search-first; this is where you disposition findings. See below.",[79,811,812,816,819],{},[94,813,814],{},[21,815,173],{},[94,817,818],{},"The risks a person has authored, with evidence liveness.",[94,820,821,822,47],{},"A separate, human-authored layer — see ",[43,823,691],{"href":690},[79,825,826,830,833],{},[94,827,828],{},[21,829,176],{},[94,831,832],{},"Limitations and the no-assurance statement, the risk register's authored-not-computed ground rules, per-source counts, and the full set of resolved parameters with attribution.",[94,834,835,836,47],{},"Read this to understand what the numbers do and do not mean — see ",[43,837,121],{"href":120},[14,839,840],{},[43,841],{"id":842},"priorities",[266,844,846],{"id":845},"priorities-what-pushes-a-row-up","Priorities — what pushes a row up",[14,848,518,849,851,852,854,855,857,858,860,861,857,864,867,868,871],{},[21,850,160],{}," tab ranks ",[103,853,421],{},", not findings, and it explains its own order. Each row shows its rank (a plain ordinal, never a score badge), the element, its inherent ",[21,856,598],{}," and ",[21,859,325],{}," band, its ",[21,862,863],{},"Likelihood",[21,865,866],{},"Impact",", and a ",[21,869,870],{},"Fired promotions"," column — short chips naming the rules that lifted the row, with the full rule sentence on hover and in the expanded row.",[14,873,874,875,878],{},"The ordering basis is stated above the table: rows are ranked by promotion tier first, then crown-jewel assets, then the worst finding band and how many findings share it. Promotions are the load-bearing part — an element is pushed up when, for example, it is both Exposed and Critical, when it carries regulated data and is reachable, or when a confirmed gap sits on an exposed surface. Because the rank is an ordinal built from visible facts, you can always answer \"why does row 3 outrank row 4\" from the row itself. Expand a row for coverage, source, and the per-element actions (affirm, open profile, raise an issue, author a risk). The ",[21,876,877],{},"Top"," selector controls how many rows are shown.",[14,880,881],{},[43,882],{"id":883},"findings",[266,885,887],{"id":886},"findings-scan-the-headers","Findings — scan the headers",[14,889,518,890,892,893,896],{},[21,891,164],{}," tab lists ten deterministic checks in two groups: five control-gap checks (F1–F5) and five architectural \u002F data-flow checks (F6–F10). Each check is a collapsible panel, and the ",[21,894,895],{},"panel header is the thing to scan"," — it shows one of three visually distinct assurance states:",[193,898,899,905,911],{},[196,900,901,904],{},[21,902,903],{},"\"N found\""," (amber) — the check fired; expand to see each instance, its evidence, and a recommended control class.",[196,906,907,910],{},[21,908,909],{},"\"checked — none found\""," (a muted positive check) — the check ran against your model and found nothing. This is a genuine, earned all-clear for that check.",[196,912,913,916,917],{},[21,914,915],{},"\"— not computable: \u003Creason>\""," — the check could not run (for example, no crown jewels or no recognised zones to evaluate). As the panel states, ",[103,918,919],{},"absence of a result is not absence of risk.",[14,921,922,923,47],{},"Every finding instance links its triggering findings into the Ledger. What each of the ten checks means, when it fires, and how to act on it is the subject of ",[43,924,164],{"href":785},[14,926,927],{},[43,928],{"id":929},"dispositions",[266,931,933],{"id":932},"ledger-where-decisions-are-recorded","Ledger — where decisions are recorded",[14,935,518,936,938,939,942,943,946],{},[21,937,170],{}," is the complete list of findings and the workbench where you act on them. It is search-first: type in the search box (or press ",[242,940,941],{},"\u002F",") to narrow the list, and the count updates live. Every deep link from the executive band — a coverage number, the excluded-findings count, a distribution cell — lands here as a removable filter breadcrumb; ",[21,944,945],{},"← back to overview"," clears them.",[14,948,949,950,953,954,956,957,960,961,964,965,967,968,971,972,975,976,979,980,983,984,987],{},"The Ledger is where you record a decision about a finding — a ",[21,951,952],{},"disposition",". Keyboard triage is built in: ",[242,955,43],{}," affirms the focused finding, ",[242,958,959],{},"r"," opens the disposition dialog to accept a risk with a reason, ",[242,962,963],{},"u"," undoes your last change, and ",[21,966,413],{}," expands a row for detail. A finding you disposition is ",[21,969,970],{},"retained with its state",", never deleted — an accepted risk that has since gone stale keeps an amber ",[21,973,974],{},"stale"," chip so it resurfaces rather than disappearing. A persisted decision can be rolled back later with the row's ",[21,977,978],{},"Clear disposition"," action. Two lenses are available: ",[21,981,982],{},"By finding"," (the default flat table) and ",[21,985,986],{},"By component"," (grouped), selectable at the top right.",[14,989,990,991,994],{},"Dispositions you make in the current session are marked ",[103,992,993],{},"\"saved — pending Recreate\""," until you regenerate the report, at which point the executive band and tabs reflect them.",[57,996,998],{"id":997},"what-to-read-next","What to read next",[193,1000,1001,1010,1015,1020,1027,1032],{},[196,1002,1003,1004,857,1008,47],{},"New to the report? Start with the ",[43,1005,1007],{"href":1006},"\u002Frisk-assessment","Risk Assessment overview",[43,1009,46],{"href":45},[196,1011,1012,1013,47],{},"Want the meaning of each of the ten finding types? See ",[43,1014,164],{"href":785},[196,1016,1017,1018,47],{},"Recording and tracking authored risks? See ",[43,1019,691],{"href":690},[196,1021,1022,1023,47],{},"Producing a deck for a board or committee? See ",[43,1024,1026],{"href":1025},"\u002Frisk-assessment\u002Fstakeholder-reports","Stakeholder Reports",[196,1028,1029,1030,47],{},"Need to know exactly what the numbers do and do not claim? See ",[43,1031,121],{"href":120},[196,1033,1034,1035,47],{},"Stuck on something specific? Check the ",[43,1036,1038],{"href":1037},"\u002Frisk-assessment\u002Ffaq","FAQ",{"title":1040,"searchDepth":1041,"depth":1041,"links":1042},"",3,[1043,1045,1051,1052,1053,1054,1055,1060],{"id":59,"depth":1044,"text":60},2,{"id":183,"depth":1044,"text":184,"children":1046},[1047,1048,1049,1050],{"id":268,"depth":1041,"text":269},{"id":303,"depth":1041,"text":304},{"id":349,"depth":1041,"text":350},{"id":406,"depth":1041,"text":407},{"id":430,"depth":1044,"text":431},{"id":514,"depth":1044,"text":515},{"id":536,"depth":1044,"text":537},{"id":578,"depth":1044,"text":579},{"id":730,"depth":1044,"text":731,"children":1056},[1057,1058,1059],{"id":845,"depth":1041,"text":846},{"id":886,"depth":1041,"text":887},{"id":932,"depth":1041,"text":933},{"id":997,"depth":1044,"text":998},"md",{},true,"\u002Frisk-assessment\u002Freading-the-report",{"title":5,"description":16},"05.risk-assessment\u002F05.reading-the-report","evnxGPjPJyHvFxq0M79X9rUMoZsk5_NWH1dU_pCl3FA",[1069,1124,1159,1214,1247,1277,1292,1362],{"title":1070,"description":1071,"path":1072,"stem":1073,"children":1074,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[1075,1079,1084,1089,1094,1099,1104,1109,1114,1119],{"title":1076,"path":1072,"stem":1077,"description":1078},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":1080,"path":1081,"stem":1082,"description":1083},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":1085,"path":1086,"stem":1087,"description":1088},"Building Your First Model","\u002Fplatform\u002Fbuilding-your-first-model","01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":1090,"path":1091,"stem":1092,"description":1093},"Security Analysis Workflow","\u002Fplatform\u002Fsecurity-analysis-workflow","01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":1095,"path":1096,"stem":1097,"description":1098},"Managing Findings","\u002Fplatform\u002Fmanaging-findings","01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":1100,"path":1101,"stem":1102,"description":1103},"Working with Security Controls","\u002Fplatform\u002Fworking-with-security-controls","01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":1105,"path":1106,"stem":1107,"description":1108},"Issue Management Guide","\u002Fplatform\u002Fissue-management-guide","01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":1110,"path":1111,"stem":1112,"description":1113},"Boundary Trust Zones","\u002Fplatform\u002Fboundary-trust-zones","01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":1115,"path":1116,"stem":1117,"description":1118},"Understanding Modules","\u002Fplatform\u002Funderstanding-modules","01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":1120,"path":1121,"stem":1122,"description":1123},"Component Configuration Guide","\u002Fplatform\u002Fcomponent-configuration-guide","01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":1125,"description":1126,"path":1127,"stem":1128,"children":1129,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[1130,1134,1139,1144,1149,1154],{"title":1131,"path":1127,"stem":1132,"description":1133},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":1135,"path":1136,"stem":1137,"description":1138},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":1140,"path":1141,"stem":1142,"description":1143},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":1145,"path":1146,"stem":1147,"description":1148},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":1150,"path":1151,"stem":1152,"description":1153},"Connecting the BYODt Deployment to the Cloud","\u002Fbyodt-cloud\u002Fcloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":1155,"path":1156,"stem":1157,"description":1158},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":1160,"description":1161,"path":1162,"stem":1163,"children":1164,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[1165,1169,1174,1179,1184,1189,1194,1199,1204,1209],{"title":1166,"path":1162,"stem":1167,"description":1168},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":1170,"path":1171,"stem":1172,"description":1173},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":1175,"path":1176,"stem":1177,"description":1178},"The 11-Step Guided Workflow","\u002Fdethereal\u002Fguided-workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":1180,"path":1181,"stem":1182,"description":1183},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":1185,"path":1186,"stem":1187,"description":1188},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":1190,"path":1191,"stem":1192,"description":1193},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":1195,"path":1196,"stem":1197,"description":1198},"Sync and Version Control","\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":1200,"path":1201,"stem":1202,"description":1203},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":1205,"path":1206,"stem":1207,"description":1208},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":1210,"path":1211,"stem":1212,"description":1213},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":1215,"description":1216,"path":1217,"stem":1218,"children":1219,"page":-1},"Threat Report","The residual-risk report over a threat model: reading it, filtering it and exporting it.","\u002Fthreat-report","04.threat-report",[1220,1223,1228,1232,1237,1242],{"title":1215,"path":1217,"stem":1221,"description":1222},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":1224,"path":1225,"stem":1226,"description":1227},"Getting Started with the Threat Report","\u002Fthreat-report\u002Fgetting-started","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":5,"path":1229,"stem":1230,"description":1231},"\u002Fthreat-report\u002Freading-the-report","04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":1233,"path":1234,"stem":1235,"description":1236},"Understanding Coverage and Gaps","\u002Fthreat-report\u002Funderstanding-coverage","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":1238,"path":1239,"stem":1240,"description":1241},"Reachability and Flow Routes","\u002Fthreat-report\u002Freachability","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":1243,"path":1244,"stem":1245,"description":1246},"Working with Findings","\u002Fthreat-report\u002Fworking-with-findings","04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":1248,"description":1249,"path":1006,"stem":1250,"children":1251,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","05.risk-assessment",[1252,1256,1260,1263,1266,1269,1270,1274],{"title":1253,"path":1006,"stem":1254,"description":1255},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":1257,"path":1037,"stem":1258,"description":1259},"FAQ and Troubleshooting","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":164,"path":785,"stem":1261,"description":1262},"05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":46,"path":45,"stem":1264,"description":1265},"05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":121,"path":120,"stem":1267,"description":1268},"05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":5,"path":1064,"stem":1066,"description":16},{"title":1271,"path":1025,"stem":1272,"description":1273},"Stakeholder Reports and Exports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":691,"path":690,"stem":1275,"description":1276},"05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":1278,"description":1279,"path":1280,"stem":1281,"children":1282,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[1283,1287],{"title":1284,"path":1280,"stem":1285,"description":1286},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":1288,"path":1289,"stem":1290,"description":1291},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":1293,"description":1294,"path":1295,"stem":1296,"children":1297,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","\u002Fagentic-modelling","07.agentic-modelling",[1298,1302,1307,1312,1317,1322,1327,1332,1337,1342,1347,1352,1357],{"title":1299,"path":1295,"stem":1300,"description":1301},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":1303,"path":1304,"stem":1305,"description":1306},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":1308,"path":1309,"stem":1310,"description":1311},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":1313,"path":1314,"stem":1315,"description":1316},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":1318,"path":1319,"stem":1320,"description":1321},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":1323,"path":1324,"stem":1325,"description":1326},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":1328,"path":1329,"stem":1330,"description":1331},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":1333,"path":1334,"stem":1335,"description":1336},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":1338,"path":1339,"stem":1340,"description":1341},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":1343,"path":1344,"stem":1345,"description":1346},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":1348,"path":1349,"stem":1350,"description":1351},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":1353,"path":1354,"stem":1355,"description":1356},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":1358,"path":1359,"stem":1360,"description":1361},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":1363,"description":1364,"path":1365,"stem":1366,"children":1367,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[1368,1372,1377],{"title":1369,"path":1365,"stem":1370,"description":1371},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":1373,"path":1374,"stem":1375,"description":1376},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":1378,"path":1379,"stem":1380,"description":1381},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748186100]