Demo Organization

Payment Platform

A worked example. Nothing here belongs to you — start your own assessment to see yours.

Coverage: 47%198 of 419 weighted scopes
Effectiveness: 61%
Maturity: 1.0 / 5

Capability against environment — the view that shows a control stopping before production.

Production

Production is a Production environment, rated Critical. The same capabilities are demanded here as in every other environment this application runs in — what criticality changes is the severity of a demand nothing meets. Here, an unmet demand is raised to critical.

Scopes demanded: 75
Covered: 40
Not covered: 35
Gaps: 40 critical11 medium

What is required here, and why

Each capability below was demanded by your profile, and expands into one scope per technology and control point it can act on. Worst first. Open one to see the control it asks for, the rule that asked for it, and what covers each scope.

0%API Security Testing0 of 3 scopes covered
- API Security Scan
  What it is
  Exposed API endpoints are tested for authentication, authorization and input-handling weaknesses.
  Why it matters
  Broken object-level authorization and a missing authentication check on one endpoint are the common API failures, and neither is visible through the user interface.
  Already doing it?
  Endpoints are exercised with valid and with wrong identities to check authentication, authorization and input handling, driven from the current API specification.
  Demanded in Production as mandatory. Required by profile rule(s): API_INTERFACE_TESTING
  Technology Control point Covered by
  REST CI Pipeline nothing
  REST Continuous Scan nothing
- API Schema Conformance Test
  What it is
  The deployed API is tested against its published specification so that undocumented or unintended endpoints are found.
  Why it matters
  Endpoints that exist but are not documented — debug routes, old versions, internal methods — are unguarded because nobody remembers they are reachable.
  Already doing it?
  The deployed API is compared with its published specification, and an undocumented endpoint or an unexpected response is a test failure.
  Demanded in Production as recommended. Required by profile rule(s): API_INTERFACE_TESTING
  Technology Control point Covered by
  REST CI Pipeline nothing
0%DAST0 of 3 scopes covered
- Automated Dynamic Scan
  What it is
  The running application is scanned automatically against a deployed test environment as part of the delivery process.
  Why it matters
  Some faults only exist once the application is assembled and configured: the deployed stack, not the source, is what an attacker meets.
  Already doing it?
  Each delivery deploys the application to a test environment and runs the scan against it automatically, with the result recorded per build.
  Demanded in Production as mandatory. Required by profile rule(s): INTERNET_FACING_DYNAMIC_TESTING
  Technology Control point Covered by
  any CI Pipeline nothing
- Authenticated Dynamic Scan
  What it is
  The dynamic scan runs authenticated so that the functionality behind the login is tested too, not only the public surface.
  Why it matters
  Almost all of an application's functionality, and most of its authorization logic, sits behind a login that an unauthenticated scan never passes.
  Already doing it?
  The scanner holds valid test credentials, stays authenticated for the whole run, and its coverage report shows the pages behind the login.
0%Kubernetes Security0 of 3 scopes covered
- Kubernetes Workload Configuration Scan
  What it is
  Workload definitions are checked for unsafe settings such as privileged containers, missing resource limits or over-broad service accounts.
  Why it matters
  A privileged container or an over-broad service account hands an attacker the rest of the cluster after a single application compromise.
  Already doing it?
  Workload manifests are checked against a hardening rule set before they are applied, and the findings go to the team that owns the manifest.
  Demanded in Production as mandatory. Required by profile rule(s): KUBERNETES_WORKLOAD_SECURITY
  Technology Control point Covered by
  Kubernetes Pull Request nothing
  Kubernetes CI Pipeline nothing
- Cluster Benchmark Assessment
  What it is
  The cluster configuration is assessed against a recognized hardening benchmark on a recurring schedule.
0%Runtime Security0 of 4 scopes covered
- Runtime Threat Detection
  What it is
  Suspicious behaviour of a running workload is detected and raised as a security event.
  Why it matters
  Preventive controls are a filter rather than a wall, and an application compromised through an unknown flaw looks normal to everything that ran before deployment.
  Already doing it?
  Agents on the workload report suspicious behaviour — unexpected processes, a shell in a container, unusual file or network activity — as events that reach whoever is on call.
  Demanded in Production as recommended. Required by profile rule(s): FINANCIAL_DATA_INTERNET_EXPOSURE
  Technology Control point Covered by
  Docker Runtime nothing
  Docker SIEM nothing
  Kubernetes Runtime nothing
  Kubernetes SIEM
33%Admission Control1 of 2 scopes covered
- Admission Policy Enforcement
  What it is
  A workload that violates policy is refused admission to the target environment, so a non-compliant deployment cannot start.
  Why it matters
  Earlier checks can be skipped, bypassed or run against a different artifact; admission is the last point at which the environment itself can say no.
  Already doing it?
  The platform rejects a workload that breaches policy, rejection rather than warning is the setting in production, and no team can deploy around it.
  Demanded in Production as mandatory. Required by profile rule(s): KUBERNETES_WORKLOAD_SECURITY
  Technology Control point Covered by
  Kubernetes Admission nothing
- Admission Policy Audit Mode
  What it is
  Policies run in audit mode in non-production environments so violations are recorded and understood before enforcement is switched on.
  Why it matters
  Switching a new policy straight to blocking in production breaks deployments, and the usual reaction is to switch the policy off for good.
  Already doing it?
33%Network Security2 of 6 scopes covered
- Network Segmentation Policy
  What it is
  Workloads may only reach the peers their function requires; everything else is denied by default.
  Why it matters
  A flat network turns one compromised workload into access to everything it can reach, which is normally everything.
  Already doing it?
  Traffic between workloads is denied unless a policy allows it, the policies are declared with the workload, and a new service starts closed rather than open.
  Demanded in Production as recommended. Required by profile rule(s): KUBERNETES_WORKLOAD_SECURITY
  Technology Control point Covered by
  Kubernetes Admission Default-deny NetworkPolicies in the cluster
  Kubernetes Runtime Default-deny NetworkPolicies in the cluster
  Azure Admission nothing
  Azure Runtime nothing
50%Drift Detection4 of 8 scopes covered
- Infrastructure Drift Detection
  What it is
  The running infrastructure is compared with its declared state so that changes made outside the pipeline are detected.
  Why it matters
  A manual fix during an incident outlives the incident: the running system stops matching the code, and the next deployment either reverts it or hides it.
  Already doing it?
  Live infrastructure is compared with its declared state on a schedule, in every environment rather than only production, and a difference is reported to the owning team.
  Demanded in Production as recommended. Required by profile rule(s): CLOUD_CONFIGURATION_BASELINE
  Technology Control point Covered by
  Kubernetes Continuous Scan Argo CD reconciliation against Git
  Kubernetes Runtime Argo CD reconciliation against Git
  Terraform Continuous Scan nothing
  Terraform Runtime

Technology	Control point	Covered by
REST	CI Pipeline	nothing
REST	Continuous Scan	nothing

Technology	Control point	Covered by
REST	CI Pipeline	nothing

Technology	Control point	Covered by
any	CI Pipeline	nothing

Technology	Control point	Covered by
Kubernetes	Pull Request	nothing
Kubernetes	CI Pipeline	nothing

Technology	Control point	Covered by
Docker	Runtime	nothing
Docker	SIEM	nothing
Kubernetes	Runtime	nothing
Kubernetes	SIEM

Technology	Control point	Covered by
Kubernetes	Admission	nothing

Technology	Control point	Covered by
Kubernetes	Admission	Default-deny NetworkPolicies in the cluster
Kubernetes	Runtime	Default-deny NetworkPolicies in the cluster
Azure	Admission	nothing
Azure	Runtime	nothing

Technology	Control point	Covered by
Kubernetes	Continuous Scan	Argo CD reconciliation against Git
Kubernetes	Runtime	Argo CD reconciliation against Git
Terraform	Continuous Scan	nothing
Terraform	Runtime

50%IaC Security2 of 4 scopes covered

IaC Misconfiguration Detection

What it is: Infrastructure-as-code definitions are checked against security policy before the change is merged, and a critical misconfiguration blocks the merge.
Why it matters: A public bucket or an open security group written into infrastructure code is deployed everywhere that module is used, and is easiest to stop in the change that introduces it.
Already doing it?: Infrastructure sources are checked against policy on every pull request, and a critical misconfiguration blocks the merge instead of producing a comment.

Demanded in Production as mandatory. Required by profile rule(s): CLOUD_CONFIGURATION_BASELINE

Technology	Control point	Covered by
Terraform	Pull Request	Checkov Terraform scan on pull requests and in CI
Terraform	CI Pipeline	Checkov Terraform scan on pull requests and in CI
Helm	Pull Request	nothing
Helm	CI Pipeline

50%Vulnerability Scanning5 of 10 scopes covered
- Known Vulnerability Scan
  What it is
  Deployed assets are matched against published CVE data to find known vulnerabilities in what is actually running.
  Why it matters
  What is running is not always what was last built — older versions stay deployed, and the inventory in somebody's head is optimistic.
  Already doing it?
  Running hosts, images and services are scanned where they are against CVE data, and each result is attributed to an owning application rather than to an address.
  Demanded in Production as mandatory. Required by profile rule(s): INTERNET_FACING_DYNAMIC_TESTING
  Technology Control point Covered by
  Java CD Pipeline nothing
  Java Continuous Scan Defender for Cloud vulnerability assessment in production
  Spring Boot CD Pipeline nothing
  Spring Boot Continuous Scan

Technology	Control point	Covered by
Java	CD Pipeline	nothing
Java	Continuous Scan	Defender for Cloud vulnerability assessment in production
Spring Boot	CD Pipeline	nothing
Spring Boot	Continuous Scan

67%Workload Identity4 of 6 scopes covered

Short-Lived Workload Identity

What it is: Each workload authenticates with a short-lived identity issued by the platform rather than with a shared credential.
Why it matters: A shared, long-lived credential can be copied out of the workload and used from anywhere, and nothing tells legitimate use apart from an attacker's.
Already doing it?: Each workload gets its own identity from the platform, the credential expires within hours and is renewed automatically, and access is granted to the identity rather than to a key.

Demanded in Production as recommended. Required by profile rule(s): CLOUD_CONFIGURATION_BASELINE

Technology	Control point	Covered by
Kubernetes	Admission	Entra Workload Identity on AKS
Kubernetes	Runtime	Entra Workload Identity on AKS
Azure	Admission	Entra Workload Identity on AKS
Azure	Runtime	Entra Workload Identity on AKS

73%SCA12 of 15 scopes covered

Dependency Composition Scan

What it is: Third-party dependencies of the application are resolved and checked against known vulnerability data on every build.
Why it matters: Most of the code being shipped was not written by the team, and a dependency becomes vulnerable long after it was chosen.
Already doing it?: The full dependency tree including transitive dependencies is resolved on every build, matched against vulnerability data, and the result is recorded.

Demanded in Production as mandatory. Required by profile rule(s): BASELINE_UNIVERSAL

Technology	Control point	Covered by
Java	Pull Request	Trivy dependency scan on pull requests and in CI
Java	CI Pipeline	Trivy dependency scan on pull requests and in CI
Spring Boot	Pull Request	Trivy dependency scan on pull requests and in CI
Spring Boot	CI Pipeline	Trivy dependency scan on pull requests and in CI

86%Penetration Testing2 of 3 scopes covered
- Periodic Penetration Test
  What it is
  A qualified tester manually attacks the application on a defined cadence and after significant architectural change.
  Why it matters
  Chained flaws and business-logic abuse need somebody who understands what the application is for; no scanner is looking for them.
  Already doing it?
  A qualified tester works against the application on a defined cadence and after significant architectural change, with an agreed scope and a written report.
  Demanded in Production as mandatory. Required by profile rule(s): INTERNET_FACING_DYNAMIC_TESTING, CRITICAL_APPLICATION_ASSURANCE, FINANCIAL_DATA_INTERNET_EXPOSURE
  Technology Control point Covered by
  any Manual Review Annual third-party penetration test
  any Manual Review Annual third-party penetration test
- Penetration Test Remediation Tracking
  What it is
  Findings from manual testing are tracked to closure under the same SLA as tool findings.
  Why it matters
100%Cloud Configuration Security2 of 2 scopes covered
- Cloud Posture Continuous Assessment
  What it is
  Deployed cloud resources are assessed continuously against configuration policy and deviations raise an alert.
  Why it matters
  Cloud resources are created by many hands and by pipelines, and one exposed storage account or over-permissive role is enough.
  Already doing it?
  Every account or subscription is assessed continuously against configuration policy, and a new deviation alerts a named owner rather than waiting for a monthly report.
  Demanded in Production as mandatory. Required by profile rule(s): CLOUD_CONFIGURATION_BASELINE
  Technology Control point Covered by
  Azure Continuous Scan Defender for Cloud posture on the production subscription
- Cloud Guardrail Enforcement
  What it is
  Platform-level guardrails prevent a non-compliant cloud resource from being created at all, instead of reporting it afterwards.
  Why it matters
  Detecting a misconfigured resource after it exists leaves a window in which it is live and reachable.
  Already doing it?
100%Container Security2 of 2 scopes covered
- Container Image Vulnerability Scan
  What it is
  Container images are scanned for vulnerable operating-system and application packages before and after they enter the registry.
  Why it matters
  Most of a container image is an operating system nobody on the team chose, and it ages between the day it is built and the day it is replaced.
  Already doing it?
  Images are scanned at build and again in the registry, covering operating-system packages as well as application dependencies, with results attached to the image digest.
  Demanded in Production as mandatory. Required by profile rule(s): KUBERNETES_WORKLOAD_SECURITY
  Technology Control point Covered by
  Docker CI Pipeline Trivy image scan in CI and registry
  Docker Registry Trivy image scan in CI and registry
100%SIEM1 of 1 scopes covered
- Security Log Centralization
  What it is
  Security-relevant logs from applications, platforms and security tools are collected centrally and retained.
  Why it matters
  Logs that stay on the machine are lost when it is replaced, and can be edited by whoever compromised it.
  Already doing it?
  Security-relevant logs from applications, platforms and security tools are shipped to a central store outside the systems that produce them, and kept for a defined period.
  Demanded in Production as mandatory. Required by profile rule(s): PERSONAL_DATA_PROTECTION, PERSONAL_DATA_INTERNET_EXPOSURE
  Technology Control point Covered by
  any SIEM Azure Monitor log pipeline
100%Vulnerability Management3 of 3 scopes covered
- Central Finding Routing
  What it is
  Findings from every source are routed into one place with a named owner, instead of staying in the tool that produced them.
  Why it matters
  Findings that stay in the tool that produced them are seen only by whoever opens that tool, and nobody can say what the whole backlog is.
  Already doing it?
  Findings from every source land in one system, each with an owning team, and a developer meets them where they already work rather than in a security console.
  Demanded in Production as recommended. Required by profile rule(s): BASELINE_UNIVERSAL
  Technology Control point Covered by
  any Manual Review DefectDojo as the finding destination
  any SIEM DefectDojo as the finding destination
- Finding SLA Tracking
  What it is
  Each finding carries a remediation deadline derived from its severity, and overdue findings are visible.
  Why it matters
  Without a deadline tied to severity, the order of remediation is decided by convenience and critical findings age quietly.

Technology	Control point	Covered by
any	Manual Review	Annual third-party penetration test
any	Manual Review	Annual third-party penetration test

Technology	Control point	Covered by
Azure	Continuous Scan	Defender for Cloud posture on the production subscription

Technology	Control point	Covered by
Docker	CI Pipeline	Trivy image scan in CI and registry
Docker	Registry	Trivy image scan in CI and registry

Technology	Control point	Covered by
any	SIEM	Azure Monitor log pipeline

Technology	Control point	Covered by
any	Manual Review	DefectDojo as the finding destination
any	SIEM	DefectDojo as the finding destination

What covers it

Trivy dependency scan on pull requests and in CI6 scopes
Defender for Cloud vulnerability assessment in production5 scopes
Trivy gate on the container build3 scopes
Argo CD reconciliation against Git4 scopes
Annual third-party penetration test2 scopes
Checkov Terraform scan on pull requests and in CI2 scopes
Trivy image scan in CI and registry2 scopes
Entra Workload Identity on AKS4 scopes
Renovate dependency update pull requests3 scopes
Default-deny NetworkPolicies in the cluster2 scopes
DefectDojo as the finding destination2 scopes
Defender for Cloud posture on the production subscription1 scope
Azure Policy deny assignments on resource deployments1 scope

Technology	Control point	Covered by
any	CI Pipeline	nothing

Dynamic Findings Block the Release

What it is: A critical finding from the dynamic scan blocks the release until it is fixed or formally excepted.
Why it matters: A scan that only reports leaves the release decision to the schedule, and a known critical issue ships because nothing stopped it.
Already doing it?: A critical dynamic finding fails the release, and overriding it needs a recorded exception with an owner and a date.

Demanded in Production as recommended. Required by profile rule(s): INTERNET_FACING_API_HARDENING

Technology	Control point	Covered by
any	Release Gate	nothing

Technology	Control point	Covered by
Kubernetes	Continuous Scan	nothing

Technology	Control point	Covered by
Kubernetes	Admission	Kyverno policies in audit mode

Egress Traffic Control

What it is: Outbound connections from production workloads are restricted to approved destinations and logged.
Why it matters: Unrestricted outbound access is how stolen data leaves and how a compromised workload fetches its next stage.
Already doing it?: Production workloads reach only approved destinations, anything else is denied and logged, and the allowed destinations are maintained per workload.

Demanded in Production as recommended. Required by profile rule(s): CLOUD_KUBERNETES_WORKLOAD_IDENTITY

Technology	Control point	Covered by
Kubernetes	Runtime	nothing
Azure	Runtime	nothing

Elimination of Static Machine Credentials

What it is: Long-lived machine credentials in pipelines and workloads are inventoried and replaced with issued identities.
Why it matters: Issued identities help nothing while the old static keys still work; removing them is what closes the path.
Already doing it?: Long-lived machine credentials in pipelines and workloads are inventoried, replaced with issued identities and revoked, and creating a new one needs an exception.

Demanded in Production as recommended. Required by profile rule(s): CLOUD_KUBERNETES_WORKLOAD_IDENTITY

Technology	Control point	Covered by
Kubernetes	Runtime	nothing
Azure	Runtime	nothing

Vulnerable Dependency Gate

What it is: A build that pulls in a dependency with a critical, fixable vulnerability is stopped rather than shipped.
Why it matters: Knowing about a critical, fixable dependency vulnerability and shipping anyway is the ordinary path by which known issues reach production.
Already doing it?: A build that pulls in a critical vulnerability with a fixed version available fails, and shipping it needs a recorded, time-bounded exception.

Demanded in Production as mandatory. Required by profile rule(s): FINANCIAL_DATA_INTERNET_EXPOSURE

Technology	Control point	Covered by
Java	CI Pipeline	Trivy gate on the container build
Java	Release Gate	nothing
Spring Boot	CI Pipeline	Trivy gate on the container build
Spring Boot	Release Gate	nothing
React	CI Pipeline	Trivy gate on the container build
React	Release Gate	nothing

Automated Dependency Updates

What it is: Outdated or vulnerable dependencies are proposed for upgrade automatically so that remediation does not depend on someone noticing.
Why it matters: Manual upgrades happen when somebody has time, which is why dependencies fall years behind and a single upgrade turns into a project.
Already doing it?: Upgrade pull requests appear by themselves, run the full test suite, and are merged as routine work instead of accumulating.

Demanded in Production as recommended. Required by profile rule(s): BASELINE_UNIVERSAL

Technology	Control point	Covered by
Java	Pull Request	Renovate dependency update pull requests
Spring Boot	Pull Request	Renovate dependency update pull requests
React	Pull Request	Renovate dependency update pull requests

Payment Platform

Development

Test

Production

Production

What is required here, and why

What covers it

What does not