[{"data":1,"prerenderedAt":2050},["ShallowReactive",2],{"page-\u002Fthreat-report\u002Fworking-with-findings":3,"navigation":1735},{"id":4,"title":5,"body":6,"description":1719,"extension":1720,"meta":1721,"navigation":1730,"path":1731,"seo":1732,"stem":1733,"__hash__":1734},"docs\u002F04.threat-report\u002F05.working-with-findings.md","Working with Findings",{"type":7,"value":8,"toc":1686},"minimark",[9,13,30,44,57,60,65,71,82,93,107,139,144,163,166,234,252,256,259,316,326,330,333,436,444,448,455,469,471,475,482,486,489,495,599,608,611,637,640,816,823,831,854,858,871,929,932,956,971,973,977,994,1004,1018,1026,1028,1032,1039,1124,1140,1176,1188,1192,1204,1206,1210,1220,1239,1243,1269,1273,1290,1297,1344,1354,1358,1375,1378,1437,1450,1454,1470,1474,1477,1504,1516,1520,1532,1536,1546,1550,1556,1558,1562,1572,1585,1592,1609,1615,1622,1630,1635,1637,1641],[10,11,5],"h1",{"id":12},"working-with-findings",[14,15,16,17,21,22,25,26,29],"p",{},"The ",[18,19,20],"strong",{},"Residual Risk"," tab is the Threat Report's findings ledger. It lists every model element that carries findings, groups the findings under the element they belong to, and separates what's still open from what you've already ",[18,23,24],{},"dispositioned",". This is where you triage: read a finding, decide what to do about it, record that decision, and move on. From any element here you can open its ",[18,27,28],{},"Component Profile"," to investigate it in depth.",[14,31,32,33,38,39,43],{},"This guide assumes you've already generated a report and know how to move between tabs. If not, start with ",[34,35,37],"a",{"href":36},"\u002Fthreat-report\u002Fgetting-started","Getting Started with the Threat Report",". The shared visual language — score bands, sensitivity chips, the freshness banner — is explained in ",[34,40,42],{"href":41},"\u002Fthreat-report\u002Freading-the-report","Reading the Report",".",[45,46,47],"blockquote",{},[14,48,49,52,53,56],{},[18,50,51],{},"The ledger never hides anything."," A dispositioned finding keeps its decision attached — who, when, and why — and is never dropped. A finding you've ",[18,54,55],{},"affirmed"," stays in the live, open set: it's a confirmed risk, not a muted one; only the muting decisions move it aside. The counts you see always describe the whole model.",[58,59],"hr",{},[61,62,64],"h2",{"id":63},"the-residual-risk-ledger","The Residual Risk Ledger",[14,66,67,68,70],{},"Open the ",[18,69,20],{}," tab. At the top you'll see a summary line such as:",[72,73,78],"pre",{"className":74,"code":76,"language":77},[75],"language-text","37 findings · 28 open · 9 dispositioned · 2 stale\n","text",[79,80,76],"code",{"__ignoreMap":81},"",[14,83,84,85,88,89,92],{},"Two parts of that line are conditional. Before you record your first decision it spells the situation out — ",[79,86,87],{},"28 open · 0 dispositioned — none dispositioned yet"," — and the ",[79,90,91],{},"· N stale"," segment appears only when at least one recorded decision has gone stale.",[14,94,95,96,99,100,102,103,106],{},"Below it, findings are organized ",[18,97,98],{},"per element",". Each element with at least one finding gets its own group, headed by the element's name (a dotted link — click it to open the ",[18,101,28],{},"), its type, and a per-element count such as ",[79,104,105],{},"5 open · 2 dispositioned",". Elements with open findings are sorted to the top, worst score band first, so the work that needs attention rises.",[45,108,109],{},[14,110,111,114,115,118,119,118,122,118,125,118,128,130,131,134,135,43],{},[18,112,113],{},"The tab strip carries no counts."," The five tabs across the top are plain labels — ",[18,116,117],{},"Posture",", ",[18,120,121],{},"Coverage & Gaps",[18,123,124],{},"Reachability",[18,126,127],{},"Boundary Crossings",[18,129,20],{}," — with no badge or backlog number on any of them. To size your triage backlog, use the ",[18,132,133],{},"Not reviewed"," filter chip inside this view; see ",[34,136,138],{"href":137},"#filtering-and-focusing","Filtering and focusing",[140,141,143],"h3",{"id":142},"zoning-advisories","Zoning advisories",[14,145,146,147,150,151,154,155,159,160,162],{},"Above the scored findings, a collapsed ",[18,148,149],{},"zoning advisories"," block may appear — per-boundary notes about your trust-zoning declarations. They are ",[18,152,153],{},"un-scored",": no band, no score, no coverage claim, and they order nothing. They sit apart from the findings ledger deliberately, because they describe a ",[156,157,158],"em",{},"boundary's"," declaration rather than a scored exposure on an element. Expand the block to read them; each note names the boundary (drillable to its ",[18,161,28],{},") with a short detail.",[14,164,165],{},"The advisories cover four things:",[167,168,174],"div",{"className":169,"tabIndex":171,"role":172,"ariaLabel":173},[170],"table-frame",0,"region","Table: Zoning advisories",[175,176,177,190],"table",{},[178,179,180],"thead",{},[181,182,183,187],"tr",{},[184,185,186],"th",{},"Advisory",[184,188,189],{},"What it flags",[191,192,193,204,214,224],"tbody",{},[181,194,195,201],{},[196,197,198],"td",{},[18,199,200],{},"Unclassified boundaries",[196,202,203],{},"A boundary with no declared zone — a modeling gap, so declare its exposure position.",[181,205,206,211],{},[196,207,208],{},[18,209,210],{},"Under-protected asset holders",[196,212,213],{},"A boundary holding sensitive assets at a lower trust tier than they warrant.",[181,215,216,221],{},[196,217,218],{},[18,219,220],{},"Management plane on an exposed tier",[196,222,223],{},"A control-plane (management) boundary sitting on an externally exposed tier.",[181,225,226,231],{},[196,227,228],{},[18,229,230],{},"Shared-domain cross-tier coupling",[196,232,233],{},"Boundaries in the same domain wired across trust tiers in a way worth a second look.",[45,235,236],{},[14,237,238,241,242,245,246,248,249,43],{},[18,239,240],{},"These are prompts, not failures."," A zoning advisory says \"review how you've zoned this boundary,\" never \"this is a violation.\" Per-flow policy verdicts — the things that can ",[156,243,244],{},"fail"," your data-flow policy — live in ",[18,247,127],{},", not here. See ",[34,250,42],{"href":251},"\u002Fthreat-report\u002Freading-the-report#the-boundary-crossings-view",[140,253,255],{"id":254},"open-versus-dispositioned","Open versus dispositioned",[14,257,258],{},"Within each group, findings sit in one of two partitions:",[167,260,263],{"className":261,"tabIndex":171,"role":172,"ariaLabel":262},[170],"Table: Open versus dispositioned",[175,264,265,275],{},[178,266,267],{},[181,268,269,272],{},[184,270,271],{},"Partition",[184,273,274],{},"What it means",[191,276,277,298],{},[181,278,279,284],{},[196,280,281],{},[18,282,283],{},"Open",[196,285,286,287,290,291,293,294,297],{},"Live work — shown as a full table. A finding is open when no decision has been recorded yet, ",[18,288,289],{},"or"," when you've ",[18,292,55],{}," it as a confirmed risk. Affirmed findings carry a ",[18,295,296],{},"Confirmed"," marker but stay here, because they are still live residual risk.",[181,299,300,305],{},[196,301,302],{},[18,303,304],{},"Dispositioned",[196,306,307,308,311,312,315],{},"A ",[156,309,310],{},"muting"," decision has been recorded (any kind other than Affirm). These move into a muted, collapsible block labeled with the count — ",[79,313,314],{},"2 dispositioned",". Expand it to see them, each with its kind, who set it, when, and the reason they wrote.",[14,317,318,319,322,323,325],{},"Recording a muting decision moves a finding into the dispositioned partition; it is set aside and counted, never deleted. ",[18,320,321],{},"Affirming"," a finding records a decision too, but keeps it in the open set with a ",[18,324,296],{}," marker — affirming says \"I've reviewed this and it's a real, live risk,\" not \"mute it.\"",[140,327,329],{"id":328},"how-to-read-a-finding-row","How to read a finding row",[14,331,332],{},"Each row in the open table has these columns:",[167,334,337],{"className":335,"tabIndex":171,"role":172,"ariaLabel":336},[170],"Table: How to read a finding row",[175,338,339,349],{},[178,340,341],{},[181,342,343,346],{},[184,344,345],{},"Column",[184,347,348],{},"What it tells you",[191,350,351,378,395,405,418],{},[181,352,353,358],{},[196,354,355],{},[18,356,357],{},"Band",[196,359,360,361,118,364,118,367,118,370,373,374,377],{},"The score band — ",[79,362,363],{},"Critical",[79,365,366],{},"High",[79,368,369],{},"Medium",[79,371,372],{},"Low",", or ",[79,375,376],{},"Unknown"," — shown as an outlined chip. This is a triage sort-aid, not a risk verdict.",[181,379,380,385],{},[196,381,382],{},[18,383,384],{},"Score",[196,386,387,388,391,392,394],{},"The numeric score (0–10). When no score is recorded the cell reads ",[79,389,390],{},"—"," and the band reads ",[18,393,376],{}," — it is never silently treated as low.",[181,396,397,402],{},[196,398,399],{},[18,400,401],{},"Finding",[196,403,404],{},"The finding's name, with its mapped MITRE ATT&CK technique chips on a sub-line beneath it (see below).",[181,406,407,412],{},[196,408,409],{},[18,410,411],{},"Vector",[196,413,414,415,417],{},"The attack vector, when one is modeled (otherwise ",[79,416,390],{},").",[181,419,420,425],{},[196,421,422],{},[18,423,424],{},"Source",[196,426,427,428,431,432,435],{},"The finding's provenance — ",[79,429,430],{},"USER"," (authored by a person) or ",[79,433,434],{},"SYSTEM"," (produced by analysis, or legacy data).",[45,437,438],{},[14,439,440,443],{},[18,441,442],{},"The band is a sort-aid, not a rating."," The report deliberately uses thin outlined chips, never solid stoplight blocks, and never rolls findings into a single overall risk number. The band orders findings for triage; it does not grade your model.",[140,445,447],{"id":446},"technique-chips","Technique chips",[14,449,450,451,454],{},"When a finding maps to one or more MITRE ATT&CK techniques, you'll see small monospace chips (such as ",[79,452,453],{},"T1190",") beneath the finding name. Click any chip to open a dialog that resolves the technique ID to its ATT&CK name, tactics, and description.",[14,456,457,458,461,462,464,465,43],{},"The chips are an identity and a launcher — nothing more. They are ",[18,459,460],{},"not"," tinted by coverage, and their absence does not assert \"no techniques.\" To see how a finding's techniques relate to your overall coverage, use the ",[18,463,121],{}," tab; see ",[34,466,468],{"href":467},"\u002Fthreat-report\u002Funderstanding-coverage","Understanding Coverage",[58,470],{},[61,472,474],{"id":473},"triaging-findings","Triaging Findings",[14,476,477,478,481],{},"Triage means deciding what to do about a finding. Each finding row carries its own ",[18,479,480],{},"action set"," — a compact 2×2 grid of glyph buttons — so you can act without leaving the ledger. Most of these hand off to the platform's own disposition dialog, the same one you'd use on the canvas, so your decisions live with the model rather than only inside the report.",[140,483,485],{"id":484},"the-action-set","The action set",[14,487,488],{},"The actions are compact glyph buttons at the right of the row. Hover one to read its label in a tooltip (screen readers get the same label).",[14,490,491,494],{},[18,492,493],{},"The set is not the same on every row."," Which actions you get is decided by two things: where the finding came from (you or the analysis) and where it is in its lifecycle.",[167,496,499],{"className":497,"tabIndex":171,"role":172,"ariaLabel":498},[170],"Table: The action set",[175,500,501,511],{},[178,502,503],{},[181,504,505,508],{},[184,506,507],{},"The finding is…",[184,509,510],{},"Actions offered",[191,512,513,531,552,568,582],{},[181,514,515,523],{},[196,516,517,520,521],{},[18,518,519],{},"Yours"," — source ",[79,522,430],{},[196,524,525,118,528],{},[18,526,527],{},"Delete",[18,529,530],{},"Issue",[181,532,533,539],{},[196,534,535,538],{},[18,536,537],{},"System",", no decision recorded yet",[196,540,541,118,544,118,547,118,550],{},[18,542,543],{},"Affirm",[18,545,546],{},"Dispose",[18,548,549],{},"Customize",[18,551,530],{},[181,553,554,559],{},[196,555,556,558],{},[18,557,537],{},", affirmed",[196,560,561,118,564,118,566],{},[18,562,563],{},"Add note",[18,565,549],{},[18,567,530],{},[181,569,570,575],{},[196,571,572,574],{},[18,573,537],{},", dispositioned (muted)",[196,576,577,118,580],{},[18,578,579],{},"Edit disposition",[18,581,530],{},[181,583,584,592],{},[196,585,586,588,589],{},[18,587,537],{},", decision has gone ",[18,590,591],{},"stale",[196,593,594,118,597],{},[18,595,596],{},"Review",[18,598,530],{},[14,600,601,602,604,605,607],{},"Stale wins over everything else in that table: whatever a system finding's lifecycle, a stale decision collapses its set to ",[18,603,596],{}," and ",[18,606,530],{}," until you re-record the decision.",[14,609,610],{},"Two consequences are worth naming, because they surprise people:",[612,613,614,621],"ul",{},[615,616,617,620],"li",{},[18,618,619],{},"You cannot affirm or dispose your own findings."," A finding you authored is yours to edit on the canvas or delete — the triage actions are for findings the analysis produced.",[615,622,623,626,627,629,630,633,634,636],{},[18,624,625],{},"An affirmed finding has no Dispose action."," To convert a confirmation into a mute, open ",[18,628,563],{},", use ",[18,631,632],{},"Remove disposition"," in that dialog to clear the affirmation, then ",[18,635,546],{}," the finding once it is back to untriaged.",[14,638,639],{},"Here is what each action does:",[167,641,643],{"className":642,"tabIndex":171,"role":172,"ariaLabel":498},[170],[175,644,645,658],{},[178,646,647],{},[181,648,649,652,655],{},[184,650,651],{},"Action",[184,653,654],{},"Glyph",[184,656,657],{},"What it does",[191,659,660,688,710,736,758,774,788,802],{},[181,661,662,666,671],{},[196,663,664],{},[18,665,543],{},[196,667,668],{},[79,669,670],{},"✓",[196,672,673,674,677,678,680,681,684,685,687],{},"Confirm the finding as a ",[18,675,676],{},"live risk"," — \"I've reviewed this and it's real.\" One click, no dialog: the row picks up a ",[18,679,296],{}," marker immediately and a snackbar offers ",[18,682,683],{},"Undo",". It is ",[156,686,460],{}," muted.",[181,689,690,694,699],{},[196,691,692],{},[18,693,546],{},[196,695,696],{},[79,697,698],{},"⊘",[196,700,701,702,706,707,709],{},"Mute the finding with a reason. Opens the disposition dialog, where you pick a muting kind (see ",[34,703,705],{"href":704},"#the-disposition-kinds","the disposition kinds"," below) and write why. The finding moves to the ",[18,708,24],{}," partition.",[181,711,712,716,721],{},[196,713,714],{},[18,715,549],{},[196,717,718],{},[79,719,720],{},"⧉",[196,722,723,724,727,728,731,732,735],{},"Take over a system finding with your own editable copy — use it when the system's finding is close but not quite right. The original is set aside as ",[18,725,726],{},"Superseded","; your copy is created on the model. Because the copy is a ",[156,729,730],{},"new"," finding, the report can't show it until you ",[18,733,734],{},"Recreate"," — the confirmation message says so.",[181,737,738,742,747],{},[196,739,740],{},[18,741,563],{},[196,743,744],{},[79,745,746],{},"✎",[196,748,749,750,753,754,757],{},"Revisit an affirmation. Opens the same dialog with the kind locked to ",[18,751,752],{},"Affirmed"," (titled ",[156,755,756],{},"Re-affirm Exposure","), so you can adjust the note without any risk of converting a confirmation into a disposal.",[181,759,760,764,768],{},[196,761,762],{},[18,763,579],{},[196,765,766],{},[79,767,746],{},[196,769,770,771,773],{},"Reopen a recorded disposition with its kind and reason loaded, to change either — or to lift it entirely with ",[18,772,632],{}," (a two-tap confirm).",[181,775,776,780,785],{},[196,777,778],{},[18,779,596],{},[196,781,782],{},[79,783,784],{},"⟳",[196,786,787],{},"The single action a stale decision offers. It reopens the right dialog for the decision you made — the re-affirm dialog for a confirmed finding, the dispose dialog for a muted one — so you can re-record it and clear the stale flag.",[181,789,790,794,799],{},[196,791,792],{},[18,793,530],{},[196,795,796],{},[79,797,798],{},"⚑",[196,800,801],{},"Raise an issue from the finding. Opens a picker to copy it to an issue board or create a new issue against the element, so the finding becomes tracked work.",[181,803,804,808,813],{},[196,805,806],{},[18,807,527],{},[196,809,810],{},[79,811,812],{},"🗑",[196,814,815],{},"Remove a finding you authored. It is a two-step confirm in place: the first click arms the button (it turns red), the second deletes. System findings are never deletable — customize or dispose them instead.",[14,817,818,819,822],{},"Every dialog on this path demands a ",[18,820,821],{},"reason"," (up to 2000 characters). It travels with the finding and is what a later reviewer reads, so write for them.",[45,824,825],{},[14,826,827,830],{},[18,828,829],{},"If the actions aren't there at all."," The action cluster renders only when the host application exposes the finding-action services to the report. On a deployment whose platform build predates them, no row shows actions and the report is a pure read surface — you can read, filter, and export, but not triage. That is a version mismatch, not a per-user setting.",[45,832,833],{},[14,834,835,838,839,842,843,846,847,849,850,43],{},[18,836,837],{},"Your decisions show up immediately — the snapshot does not change."," A decision you record here is patched onto the rows in front of you at once (the marker appears, the row moves partition), and a note above the tabs counts them: ",[156,840,841],{},"Reflecting N changes made since this snapshot was generated."," The stored snapshot itself still describes the model as of generation, which is why ",[18,844,845],{},"exports are disabled"," while those changes are pending. Click ",[18,848,734],{}," — in that note or in the banner — to fold them into a fresh snapshot and refresh the derived views. See ",[34,851,853],{"href":852},"\u002Fthreat-report\u002Fgetting-started#snapshots-and-freshness","Getting Started",[140,855,857],{"id":856},"the-disposition-kinds","The disposition kinds",[14,859,860,861,864,865,867,868,870],{},"Every finding in this ledger is an ",[18,862,863],{},"exposure",", and when you ",[18,866,546],{}," one the dialog offers exactly four muting kinds. Choose the one that matches your actual reasoning — the label travels with the finding and is what a later reviewer will read. (To keep a finding live instead of muting it, use ",[18,869,543],{},", not one of these.)",[167,872,875],{"className":873,"tabIndex":171,"role":172,"ariaLabel":874},[170],"Table: The disposition kinds",[175,876,877,887],{},[178,878,879],{},[181,880,881,884],{},[184,882,883],{},"Disposition",[184,885,886],{},"Use it when",[191,888,889,899,909,919],{},[181,890,891,896],{},[196,892,893],{},[18,894,895],{},"Not Applicable",[196,897,898],{},"The finding doesn't apply to this element as modeled — the condition it describes isn't present here.",[181,900,901,906],{},[196,902,903],{},[18,904,905],{},"False Positive",[196,907,908],{},"The finding was raised in error. It is not a real exposure for this element.",[181,910,911,916],{},[196,912,913],{},[18,914,915],{},"Compensating Control",[196,917,918],{},"A real exposure, but another control already mitigates it to your satisfaction. State which control in the reason.",[181,920,921,926],{},[196,922,923],{},[18,924,925],{},"Risk Accepted",[196,927,928],{},"A real, unmitigated exposure that the business has consciously decided to accept. Record who accepted it and why.",[14,930,931],{},"Two further kinds exist in the platform, and neither is offered here:",[612,933,934,942],{},[615,935,936,938,939,941],{},[18,937,726],{}," is never something you pick. It is what the ",[18,940,549],{}," action sets on the original when it creates your editable copy.",[615,943,944,947,948,951,952,43],{},[18,945,946],{},"Waived"," is a ",[156,949,950],{},"countermeasure"," kind — a decision not to implement a control. Countermeasures are triaged on the control, not in this report; see ",[34,953,955],{"href":954},"\u002Fplatform\u002Fmanaging-findings","Managing Findings",[45,957,958],{},[14,959,960,963,964,966,967,970],{},[18,961,962],{},"A consistency check, not coverage math."," If you mark a finding ",[18,965,915],{}," on an element that has ",[156,968,969],{},"no"," control present in the model, the ledger flags that as an auditable inconsistency — a claim with nothing backing it. It doesn't block you; it surfaces the gap so you can reconcile the model.",[58,972],{},[61,974,976],{"id":975},"stale-dispositions","Stale Dispositions",[14,978,979,980,982,983,986,987,990,991,993],{},"A recorded decision can be flagged ",[18,981,591],{},". In the dispositioned block the finding's row picks up an amber left edge and its decision line carries a ",[79,984,985],{},"⚠ stale"," marker; in the open table a stale ",[156,988,989],{},"affirmation"," carries no marker of its own — what tells you is the row's action set, which has collapsed to ",[18,992,596],{},". Either way, the count of stale decisions appears in the summary line at the top of the tab.",[14,995,996,999,1000,604,1002,43],{},[18,997,998],{},"Stale means the underlying finding changed after the decision was recorded."," The attributes the decision was based on are no longer the attributes in front of you, so the decision may no longer hold. The flag is a prompt to revisit — and the row makes that the only thing you can do: a stale finding's action set collapses to ",[18,1001,596],{},[18,1003,530],{},[14,1005,1006,1007,1009,1010,1013,1014,1017],{},"Click ",[18,1008,596],{},". It opens the dialog that matches the decision you originally made — the re-affirm dialog for a confirmed finding, the dispose dialog for a muted one — with a warning at the top: ",[156,1011,1012],{},"Model attributes changed since this disposition was set. Review and re-affirm if it still applies."," Re-read the finding, adjust the reason if your reasoning has moved, and save with ",[18,1015,1016],{},"Re-affirm",". That re-stamps the decision with your name and the current time, and clears the flag. Don't trust a stale call at face value.",[45,1019,1020],{},[14,1021,1022,1025],{},[18,1023,1024],{},"Why this matters."," A \"Risk Accepted\" or \"Compensating Control\" decision made against an earlier version of a finding can quietly stop reflecting reality. Surfacing staleness keeps an out-of-date decision from silently guarding a live exposure.",[58,1027],{},[61,1029,1031],{"id":1030},"filtering-and-focusing","Filtering and Focusing",[14,1033,1034,1035,1038],{},"When the ledger is large, the filter bar narrows it to what you care about. It sits just under the summary line (labelled ",[18,1036,1037],{},"Filter",", and shown only when the model has findings at all) and offers four groups of facets plus a clear control.",[167,1040,1043],{"className":1041,"tabIndex":171,"role":172,"ariaLabel":1042},[170],"Table: Filtering and Focusing",[175,1044,1045,1055],{},[178,1046,1047],{},[181,1048,1049,1052],{},[184,1050,1051],{},"Facet group",[184,1053,1054],{},"Choices",[191,1056,1057,1076,1089,1102],{},[181,1058,1059,1063],{},[196,1060,1061],{},[18,1062,357],{},[196,1064,1065,118,1067,118,1069,118,1071,118,1073,1075],{},[79,1066,363],{},[79,1068,366],{},[79,1070,369],{},[79,1072,372],{},[79,1074,376],{}," — only the bands actually present in the model get a chip",[181,1077,1078,1082],{},[196,1079,1080],{},[18,1081,424],{},[196,1083,1084,118,1087],{},[79,1085,1086],{},"User",[79,1088,537],{},[181,1090,1091,1096],{},[196,1092,1093],{},[18,1094,1095],{},"Status",[196,1097,1098,118,1100],{},[79,1099,133],{},[79,1101,296],{},[181,1103,1104,1109],{},[196,1105,1106],{},[18,1107,1108],{},"Element type",[196,1110,1111,118,1114,118,1117,118,1120,1123],{},[79,1112,1113],{},"Component",[79,1115,1116],{},"Data",[79,1118,1119],{},"Boundary",[79,1121,1122],{},"Data Flow"," — only the types present in the model appear",[14,1125,1126,1127,1129,1130,1132,1133,1135,1136,1139],{},"Every chip carries its whole-model count. ",[18,1128,1095],{}," is the one to reach for when you want to size your triage backlog: ",[79,1131,133],{}," selects the live findings nobody has decided on yet, ",[79,1134,296],{}," the live ones you have affirmed. Both are ",[156,1137,1138],{},"live"," states, so selecting either empties the dispositioned block — a muted finding is neither.",[14,1141,1142,1143,118,1146,118,1149,118,1152,1155,1156,1159,1160,1162,1163,1162,1165,1167,1168,1171,1172,1175],{},"Each facet you turn on appears as a removable breadcrumb chip above the view, labelled with its group: ",[79,1144,1145],{},"band: High",[79,1147,1148],{},"source: System",[79,1150,1151],{},"status: Not reviewed",[79,1153,1154],{},"type: Component",". One choice per group, and the groups ",[18,1157,1158],{},"combine"," — ",[79,1161,1145],{}," plus ",[79,1164,1148],{},[79,1166,1154],{}," shows only high-band system findings on components. Click a chip again, or use the ",[18,1169,1170],{},"✕ clear"," control, to remove a filter. When a filter matches nothing, the ledger says ",[79,1173,1174],{},"No findings match the current filter."," rather than appearing empty.",[45,1177,1178],{},[14,1179,1180,1183,1184,1187],{},[18,1181,1182],{},"A selector, not a recount."," Turning a facet on changes what is ",[156,1185,1186],{},"displayed",". The counts on the chips and in the summary line never move — they always describe the whole model.",[140,1189,1191],{"id":1190},"arriving-pre-filtered","Arriving pre-filtered",[14,1193,1194,1195,1197,1198,1200,1201,1203],{},"You can also reach this view already filtered. On the ",[18,1196,117],{}," tab, clicking a roll-up statistic (for example a band count) jumps you straight to ",[18,1199,20],{}," with the matching filter applied and shown as a breadcrumb. Clear it to see everything again. See ",[34,1202,42],{"href":41}," for the Posture roll-up.",[58,1205],{},[61,1207,1209],{"id":1208},"investigating-an-element-the-component-profile","Investigating an Element: the Component Profile",[14,1211,1212,1213,1215,1216,1219],{},"When a single finding row isn't enough context, open the element's ",[18,1214,28],{},". Click the element's name in the ledger (or any element link anywhere in the report). The profile opens as an overlay; close it with ",[18,1217,1218],{},"Esc",", the scrim, or its close button, and you return exactly where you were.",[14,1221,1222,1223,1226,1227,1229,1230,1229,1233,1235,1236,1238],{},"The profile ",[156,1224,1225],{},"synthesizes"," one element's residual risk — it is not a re-skin of the canvas inspector. It works for a ",[18,1228,1113],{},", a ",[18,1231,1232],{},"Security Boundary",[18,1234,1116],{}," element, or a ",[18,1237,1122],{},", adapting its sections to the element's type.",[140,1240,1242],{"id":1241},"identity","Identity",[14,1244,1245,1246,1249,1250,1252,1253,118,1256,118,1259,118,1262,373,1265,1268],{},"The header shows the element's name, its type, and — where relevant — a ",[79,1247,1248],{},"★ crown jewel"," badge for an author-flagged high-value asset and, for a ",[18,1251,1116],{}," element, its sensitivity chip (",[79,1254,1255],{},"Public",[79,1257,1258],{},"Internal",[79,1260,1261],{},"Confidential",[79,1263,1264],{},"Restricted",[79,1266,1267],{},"unknown"," when none is set — never \"low\").",[140,1270,1272],{"id":1271},"boundary-context","Boundary context",[14,1274,1275,1276,1278,1279,1282,1283,373,1286,1289],{},"For a Component or a Security Boundary, the ",[18,1277,1272],{}," section lists the nesting stack from innermost to outer. Each boundary is itself drillable, and carries its own posture inline: ",[79,1280,1281],{},"⚠ N live"," exposures (with the worst band), ",[79,1284,1285],{},"✓ control present",[79,1287,1288],{},"· no modeled posture",". This tells you what surrounds the element you're investigating — a weak boundary above a sound component is still a path in.",[14,1291,1292,1293,1296],{},"Each boundary in the stack also carries its ",[18,1294,1295],{},"declared trust-zoning tags",", when they're set:",[612,1298,1299,1329],{},[615,1300,1301,1302,1305,1306,118,1309,118,1312,118,1315,118,1318,373,1321,1324,1325,1328],{},"Its ",[18,1303,1304],{},"zone chip"," — the boundary's declared exposure position (",[79,1307,1308],{},"UNTRUSTED",[79,1310,1311],{},"PUBLIC",[79,1313,1314],{},"EXPOSED",[79,1316,1317],{},"INTERNAL",[79,1319,1320],{},"RESTRICTED",[79,1322,1323],{},"VENDOR","). This is the ",[156,1326,1327],{},"effective"," zone, which a boundary may inherit from a parent or fall back to a default; hover the chip to see which. A boundary shows no chip on a snapshot generated before zoning was modeled.",[615,1330,1331,1332,1335,1336,1339,1340,1343],{},"Its declared ",[18,1333,1334],{},"planes"," (for example ",[79,1337,1338],{},"management",") and ",[18,1341,1342],{},"domains"," — muted context tags, not a verdict.",[14,1345,1346,1347,1350,1351,1353],{},"These are the operator's ",[18,1348,1349],{},"declaration",", never recomputed by the report. A chip is an exposure position, not a safety rating — ",[79,1352,1320],{}," means \"declared most sensitive,\" not \"protected.\"",[140,1355,1357],{"id":1356},"trust-zoning","Trust zoning",[14,1359,1360,1361,1364,1365,1367,1368,1370,1371,1374],{},"When the element you're drilled into ",[156,1362,1363],{},"is"," a ",[18,1366,1232],{},", a dedicated ",[18,1369,1357],{}," block spells out its declared zoning in full. It's labelled ",[156,1372,1373],{},"declared intent, not enforcement"," — the report reads what you declared, it never proves the boundary is enforced.",[14,1376,1377],{},"The block shows:",[612,1379,1380,1401,1410,1427],{},[615,1381,1382,1385,1386,1389,1390,1393,1394,1397,1398,43],{},[18,1383,1384],{},"Zone"," — the boundary's effective zone chip and where it comes from: ",[79,1387,1388],{},"declared"," (set on this boundary), ",[79,1391,1392],{},"inherited from \u003Cboundary>"," (taken from an ancestor), or ",[79,1395,1396],{},"default (no zone declared)",". If the snapshot has no zoning, it reads ",[79,1399,1400],{},"— (no zoning computed)",[615,1402,1403,604,1406,1409],{},[18,1404,1405],{},"Planes",[18,1407,1408],{},"Domains"," — the boundary's own declared tags, when set.",[615,1411,1412,1415,1416,1419,1420,1422,1423,1426],{},[18,1413,1414],{},"Conduits out"," — the declared ",[18,1417,1418],{},"conduits"," (approved channels) from this boundary to a peer. A conduit is a ",[156,1421,1388],{}," intended channel — declared intent, not proven enforcement. Each peer is drillable; each carries its justification, or ",[79,1424,1425],{},"no justification"," where none was recorded.",[615,1428,1429,1432,1433,1436],{},[18,1430,1431],{},"Conduits in"," — the mirror: peers that declared a conduit reaching ",[156,1434,1435],{},"this"," boundary. Also drillable, also with justification.",[45,1438,1439],{},[14,1440,1441,1444,1445,1447,1448,43],{},[18,1442,1443],{},"A conduit is a declaration, not a permission."," The block records channels you said are approved; it does not verify they're enforced, and it never issues a per-flow verdict. Whether an individual flow through a boundary is legal is judged crossing by crossing in ",[18,1446,127],{}," — see ",[34,1449,42],{"href":251},[140,1451,1453],{"id":1452},"exposures","Exposures",[14,1455,16,1456,1458,1459,1461,1462,1465,1466,1469],{},[18,1457,1453],{}," section shows the element's own findings, partitioned exactly like the ledger: an open table (including affirmed, ",[18,1460,296],{},"-marked findings) and a collapsible ",[79,1463,1464],{},"N dispositioned"," block, each finding carrying its band, score, vector, source, and ATT&CK technique chips. An open finding on an element with no supporting control is flagged ",[79,1467,1468],{},"⛉ uncovered",". The flag marks \"no control applied to this element,\" not a coverage grade, and a data item gets it exactly like any other element: with no control of its own it shows the flag, and with one it doesn't. You can triage right here — each row carries the same provenance-and-lifecycle action set as the ledger, and every action behaves identically.",[140,1471,1473],{"id":1472},"data-relations-in-both-directions","Data relations, in both directions",[14,1475,1476],{},"The profile shows data relationships from whichever side you're standing on:",[612,1478,1479,1489],{},[615,1480,1481,1484,1485,1488],{},[18,1482,1483],{},"Data handled"," — appears on a ",[156,1486,1487],{},"handler"," (a Component, Boundary, or Data Flow). It lists each data item the element touches, with that item's sensitivity and its own exposure counts. Every data item is drillable.",[615,1490,1491,1484,1494,1496,1497,118,1499,373,1501,1503],{},[18,1492,1493],{},"Handled by",[156,1495,1116],{}," element. It is the inverse: the components, data flows, and security boundaries that touch this data, each with its own posture (",[79,1498,1281],{},[79,1500,1285],{},[79,1502,1288],{},") and each drillable.",[45,1505,1506],{},[14,1507,1508,1511,1512,1515],{},[18,1509,1510],{},"Each side keeps its own controls."," A handler's coverage is its own, and the \"Data handled\" block says so: the counts it shows are each data item's own exposures, not the handler's posture. A control you apply to a data item is the data item's own — it appears in that data item's profile, and, when the data item has at least one open exposure mapped to ATT&CK, in ",[34,1513,121],{"href":1514},"\u002Fthreat-report\u002Funderstanding-coverage#data-exposures-off-the-grid-but-disclosed"," beside the data item, as assigned and not graded. Neither side's controls count across the handling relationship: a handler's controls don't cover the data item, and the data item's don't cover the handler.",[140,1517,1519],{"id":1518},"controls-present","Controls present",[14,1521,16,1522,1524,1525,1528,1529,1531],{},[18,1523,1519],{}," section lists the element's controls as ",[18,1526,1527],{},"defense-in-depth context"," — and labels itself that way. It is deliberately ",[156,1530,460],{}," a coverage claim. See the next section.",[140,1533,1535],{"id":1534},"connected-components-and-the-minimap","Connected components and the minimap",[14,1537,1538,1541,1542,1545],{},[18,1539,1540],{},"Connected components"," lists the element's 1-hop flow neighbors, each tagged with direction (inbound \u002F outbound, or source \u002F target for a Data Flow), the flow that connects them, and the carried sensitivity. Each neighbor is drillable. Alongside, a ",[18,1543,1544],{},"minimap"," highlights the element (or, for a Data Flow, its two endpoints and the edge between them) on the model so you can place it spatially.",[140,1547,1549],{"id":1548},"navigating-and-triaging-in-place","Navigating and triaging in place",[14,1551,1552,1553,1555],{},"Every related element in the profile — boundaries, data items, handlers, neighbors — is a drillable link, so you can walk the graph from element to element without leaving the overlay. An element that no longer exists in the snapshot is shown as plain, non-clickable text rather than a dead link. And because the ",[18,1554,1453],{}," section carries the same triage actions as the ledger, you can record decisions while you investigate, not only from the main tab.",[58,1557],{},[61,1559,1561],{"id":1560},"reading-controls-honestly","Reading Controls Honestly",[14,1563,1564,1565,1568,1569,1571],{},"Controls appear in two places — the ",[79,1566,1567],{},"Controls present (N):"," line at the head of each ledger group, and the ",[18,1570,1519],{}," section of the profile — and in neither does listing a control claim it covers a particular finding.",[14,1573,1574,1575,1578,1579,1581,1582,1584],{},"The profile is explicit about it: its section header reads ",[156,1576,1577],{},"defense-in-depth context — not a coverage claim",". There is no control-to-finding mapping behind that list, so the absence of an ",[79,1580,1468],{}," flag does ",[18,1583,460],{}," mean \"covered\" — it means the relationship hasn't been evaluated at the level of an individual finding.",[140,1586,16,1588,1591],{"id":1587},"the-mismatched-flag",[79,1589,1590],{},"⚠ mismatched"," flag",[14,1593,1594,1595,1597,1598,1601,1602,1605,1606,1608],{},"One control signal in the ledger ",[156,1596,1363],{}," derived from coverage facts, and only appears when the ",[18,1599,1600],{},"Coverage Tools"," module is deployed. A control on an element that contributes nothing — neither prevention nor detection — against ",[18,1603,1604],{},"any"," of that element's modeled techniques is tagged ",[79,1607,1590],{}," and sorted to the front of the group's control line, with a note:",[72,1610,1613],{"className":1611,"code":1612,"language":77},[75],"⚠ 2 control(s) here are configured-but-mismatched — present on this element but\npointed at threats it doesn't model, while real gaps stay open.\n",[79,1614,1612],{"__ignoreMap":81},[14,1616,1617,1618,1621],{},"Read it precisely. It is an element-level statement, not a per-finding one: an ",[156,1619,1620],{},"unflagged"," control covers at least one of the element's modeled techniques — which is not the same as covering the finding in front of you. And a mismatched control is not a broken control; it may be defending against something this model doesn't describe. What the flag is good for is spotting a control credited on paper while the element's actual modeled gaps stay open.",[45,1623,1624],{},[14,1625,1626,1629],{},[18,1627,1628],{},"Why the report is careful here."," A false sense of coverage is worse than none. Treat a listed control as something present in the model worth knowing about — then judge for yourself, in the disposition reason, whether it actually mitigates the open exposure.",[14,1631,1632,1633,43],{},"For how techniques map to genuine coverage analysis, see ",[34,1634,468],{"href":467},[58,1636],{},[61,1638,1640],{"id":1639},"next-steps","Next Steps",[612,1642,1643,1655,1662,1670,1677],{},[615,1644,1645,1649,1650,1652,1653,43],{},[18,1646,1647],{},[34,1648,42],{"href":41}," — the shared visual language, the ",[18,1651,117],{}," roll-up, and ",[18,1654,127],{},[615,1656,1657,1661],{},[18,1658,1659],{},[34,1660,468],{"href":467}," — how a finding's techniques relate to your MITRE ATT&CK coverage.",[615,1663,1664,1669],{},[18,1665,1666],{},[34,1667,124],{"href":1668},"\u002Fthreat-report\u002Freachability"," — which crown jewels are reachable, and what sits on the route.",[615,1671,1672,1676],{},[18,1673,1674],{},[34,1675,853],{"href":36}," — generating, refreshing, and exporting the report.",[615,1678,1679,1685],{},[18,1680,1681],{},[34,1682,1684],{"href":1683},"\u002Fthreat-report","Guide Index"," — the full Threat Report documentation set.",{"title":81,"searchDepth":1687,"depth":1687,"links":1688},3,[1689,1696,1700,1701,1704,1714,1718],{"id":63,"depth":1690,"text":64,"children":1691},2,[1692,1693,1694,1695],{"id":142,"depth":1687,"text":143},{"id":254,"depth":1687,"text":255},{"id":328,"depth":1687,"text":329},{"id":446,"depth":1687,"text":447},{"id":473,"depth":1690,"text":474,"children":1697},[1698,1699],{"id":484,"depth":1687,"text":485},{"id":856,"depth":1687,"text":857},{"id":975,"depth":1690,"text":976},{"id":1030,"depth":1690,"text":1031,"children":1702},[1703],{"id":1190,"depth":1687,"text":1191},{"id":1208,"depth":1690,"text":1209,"children":1705},[1706,1707,1708,1709,1710,1711,1712,1713],{"id":1241,"depth":1687,"text":1242},{"id":1271,"depth":1687,"text":1272},{"id":1356,"depth":1687,"text":1357},{"id":1452,"depth":1687,"text":1453},{"id":1472,"depth":1687,"text":1473},{"id":1518,"depth":1687,"text":1519},{"id":1534,"depth":1687,"text":1535},{"id":1548,"depth":1687,"text":1549},{"id":1560,"depth":1690,"text":1561,"children":1715},[1716],{"id":1587,"depth":1687,"text":1717},"The ⚠ mismatched flag",{"id":1639,"depth":1690,"text":1640},"The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile","md",{"category":1722,"position":1723,"tags":1724},"documentation",6,[1725,1726,1727,1728,1729],"threat-report","residual-risk","findings","dispositions","component-profile",true,"\u002Fthreat-report\u002Fworking-with-findings",{"title":5,"description":1719},"04.threat-report\u002F05.working-with-findings","S0aBBLyamIgIHIPpP9YRuRMgyB4kEzFXf7x-Mcad8ls",[1736,1789,1824,1879,1902,1945,1960,2030],{"title":1737,"description":1738,"path":1739,"stem":1740,"children":1741,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[1742,1746,1751,1756,1761,1764,1769,1774,1779,1784],{"title":1743,"path":1739,"stem":1744,"description":1745},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":1747,"path":1748,"stem":1749,"description":1750},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":1752,"path":1753,"stem":1754,"description":1755},"Building Your First Model","\u002Fplatform\u002Fbuilding-your-first-model","01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":1757,"path":1758,"stem":1759,"description":1760},"Security Analysis Workflow","\u002Fplatform\u002Fsecurity-analysis-workflow","01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":955,"path":954,"stem":1762,"description":1763},"01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":1765,"path":1766,"stem":1767,"description":1768},"Working with Security Controls","\u002Fplatform\u002Fworking-with-security-controls","01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":1770,"path":1771,"stem":1772,"description":1773},"Issue Management Guide","\u002Fplatform\u002Fissue-management-guide","01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":1775,"path":1776,"stem":1777,"description":1778},"Boundary Trust Zones","\u002Fplatform\u002Fboundary-trust-zones","01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":1780,"path":1781,"stem":1782,"description":1783},"Understanding Modules","\u002Fplatform\u002Funderstanding-modules","01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":1785,"path":1786,"stem":1787,"description":1788},"Component Configuration Guide","\u002Fplatform\u002Fcomponent-configuration-guide","01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":1790,"description":1791,"path":1792,"stem":1793,"children":1794,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[1795,1799,1804,1809,1814,1819],{"title":1796,"path":1792,"stem":1797,"description":1798},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":1800,"path":1801,"stem":1802,"description":1803},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":1805,"path":1806,"stem":1807,"description":1808},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":1810,"path":1811,"stem":1812,"description":1813},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":1815,"path":1816,"stem":1817,"description":1818},"Connecting the BYODt Deployment to the Cloud","\u002Fbyodt-cloud\u002Fcloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":1820,"path":1821,"stem":1822,"description":1823},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":1825,"description":1826,"path":1827,"stem":1828,"children":1829,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[1830,1834,1839,1844,1849,1854,1859,1864,1869,1874],{"title":1831,"path":1827,"stem":1832,"description":1833},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":1835,"path":1836,"stem":1837,"description":1838},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":1840,"path":1841,"stem":1842,"description":1843},"The 11-Step Guided Workflow","\u002Fdethereal\u002Fguided-workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":1845,"path":1846,"stem":1847,"description":1848},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":1850,"path":1851,"stem":1852,"description":1853},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":1855,"path":1856,"stem":1857,"description":1858},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":1860,"path":1861,"stem":1862,"description":1863},"Sync and Version Control","\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":1865,"path":1866,"stem":1867,"description":1868},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":1870,"path":1871,"stem":1872,"description":1873},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":1875,"path":1876,"stem":1877,"description":1878},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":1880,"description":1881,"path":1683,"stem":1882,"children":1883,"page":-1},"Threat Report","The residual-risk report over a threat model: reading it, filtering it and exporting it.","04.threat-report",[1884,1887,1890,1893,1897,1901],{"title":1880,"path":1683,"stem":1885,"description":1886},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":37,"path":36,"stem":1888,"description":1889},"04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":42,"path":41,"stem":1891,"description":1892},"04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":1894,"path":467,"stem":1895,"description":1896},"Understanding Coverage and Gaps","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":1898,"path":1668,"stem":1899,"description":1900},"Reachability and Flow Routes","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":5,"path":1731,"stem":1733,"description":1719},{"title":1903,"description":1904,"path":1905,"stem":1906,"children":1907,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","\u002Frisk-assessment","05.risk-assessment",[1908,1912,1917,1922,1926,1931,1935,1940],{"title":1909,"path":1905,"stem":1910,"description":1911},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":1913,"path":1914,"stem":1915,"description":1916},"FAQ and Troubleshooting","\u002Frisk-assessment\u002Ffaq","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":1918,"path":1919,"stem":1920,"description":1921},"Findings","\u002Frisk-assessment\u002Ffindings","05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":853,"path":1923,"stem":1924,"description":1925},"\u002Frisk-assessment\u002Fgetting-started","05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":1927,"path":1928,"stem":1929,"description":1930},"Methodology and Trust","\u002Frisk-assessment\u002Fmethodology-and-trust","05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":42,"path":1932,"stem":1933,"description":1934},"\u002Frisk-assessment\u002Freading-the-report","05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":1936,"path":1937,"stem":1938,"description":1939},"Stakeholder Reports and Exports","\u002Frisk-assessment\u002Fstakeholder-reports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":1941,"path":1942,"stem":1943,"description":1944},"The Risk Register","\u002Frisk-assessment\u002Fthe-risk-register","05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":1946,"description":1947,"path":1948,"stem":1949,"children":1950,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[1951,1955],{"title":1952,"path":1948,"stem":1953,"description":1954},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":1956,"path":1957,"stem":1958,"description":1959},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":1961,"description":1962,"path":1963,"stem":1964,"children":1965,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","\u002Fagentic-modelling","07.agentic-modelling",[1966,1970,1975,1980,1985,1990,1995,2000,2005,2010,2015,2020,2025],{"title":1967,"path":1963,"stem":1968,"description":1969},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":1971,"path":1972,"stem":1973,"description":1974},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":1976,"path":1977,"stem":1978,"description":1979},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":1981,"path":1982,"stem":1983,"description":1984},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":1986,"path":1987,"stem":1988,"description":1989},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":1991,"path":1992,"stem":1993,"description":1994},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":1996,"path":1997,"stem":1998,"description":1999},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":2001,"path":2002,"stem":2003,"description":2004},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":2006,"path":2007,"stem":2008,"description":2009},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":2011,"path":2012,"stem":2013,"description":2014},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":2016,"path":2017,"stem":2018,"description":2019},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":2021,"path":2022,"stem":2023,"description":2024},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":2026,"path":2027,"stem":2028,"description":2029},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":2031,"description":2032,"path":2033,"stem":2034,"children":2035,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[2036,2040,2045],{"title":2037,"path":2033,"stem":2038,"description":2039},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":2041,"path":2042,"stem":2043,"description":2044},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":2046,"path":2047,"stem":2048,"description":2049},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748184958]