A worked example. Nothing here belongs to you — start your own assessment to see yours.
198 weight covered221 weight not covered
Do we have the necessary security controls everywhere we need them?
Are those controls actually effective, or do scanners just run alongside?
Has this become a governable, measurable, continuously improved process?
11 uncovered or weak scopes, and 5 jobs that would close them.
Closing it changes no coverage — it is already counted as covered.
Closing it changes no coverage — it is already counted as covered.
OWASP ZAP is already in your stack and says it can do this.Open
Closing it changes no coverage — it is already counted as covered.
GitHub Advanced Security, Semgrep are already in your stack and say they can do this.Open
Closing it changes no coverage — it is already counted as covered.
Closing it changes no coverage — it is already counted as covered.
