A worked example. Nothing here belongs to you — start your own assessment to see yours.
198 weight covered221 weight not covered
Do we have the necessary security controls everywhere we need them?
Are those controls actually effective, or do scanners just run alongside?
Has this become a governable, measurable, continuously improved process?
40 uncovered or weak scopes, and 19 jobs that would close them.
Closing it adds 2.1% coverage.
GitHub Advanced Security, Semgrep are already in your stack and say they can do this.Open
Closing it changes no coverage — it is already counted as covered.
GitHub Advanced Security, Semgrep are already in your stack and say they can do this.Open
Closing it adds 2.4% coverage.
Closing it adds 1.9% coverage.
Closing it adds 1.9% coverage.
Microsoft Defender for Cloud is already in your stack and says it can do this.Open
Closing it changes no coverage — it is already counted as covered.
OWASP ZAP is already in your stack and says it can do this.Open
Closing it adds 0.2% coverage.
OWASP ZAP is already in your stack and says it can do this.Open
Closing it adds 0.7% coverage.
Closing it adds 0.2% coverage.
Closing it adds 0.2% coverage.
Closing it adds 1.0% coverage.
Trivy is already in your stack and says it can do this.Open
Closing it adds 0.5% coverage.
Closing it adds 0.5% coverage.
Closing it adds 0.5% coverage.
OWASP ZAP is already in your stack and says it can do this.Open
Closing it adds 0.2% coverage.
OWASP ZAP is already in your stack and says it can do this.Open
Closing it adds 0.5% coverage.
Checkov, Kyverno, Microsoft Defender for Cloud, Trivy are already in your stack and say they can do this.Open
Closing it adds 0.2% coverage.
Checkov, Kyverno, Microsoft Defender for Cloud, Trivy are already in your stack and say they can do this.Open
Closing it adds 0.5% coverage.
Closing it adds 0.5% coverage.
