A worked example. Nothing here belongs to you — start your own assessment to see yours.
198 weight covered221 weight not covered
Do we have the necessary security controls everywhere we need them?
Are those controls actually effective, or do scanners just run alongside?
Has this become a governable, measurable, continuously improved process?
55 uncovered or weak scopes, and 27 jobs that would close them.
Something has to be introduced. These are the only jobs that move the coverage number.
Closing it adds 2.4% coverage.
Closing it adds 2.4% coverage.
Closing it adds 2.1% coverage.
GitHub Advanced Security, Semgrep are already in your stack and say they can do this.Open
Closing it adds 1.9% coverage.
Closing it adds 1.9% coverage.
Microsoft Defender for Cloud is already in your stack and says it can do this.Open
Closing it adds 1.4% coverage.
OWASP ZAP is already in your stack and says it can do this.Open
Closing it adds 1.0% coverage.
Closing it adds 1.0% coverage.
Trivy is already in your stack and says it can do this.Open
Closing it adds 0.7% coverage.
Closing it adds 0.5% coverage.
OWASP ZAP is already in your stack and says it can do this.Open
Closing it adds 0.5% coverage.
Closing it adds 0.5% coverage.
Checkov, Kyverno, Microsoft Defender for Cloud, Trivy are already in your stack and say they can do this.Open
Closing it adds 0.5% coverage.
Closing it adds 0.5% coverage.
Closing it adds 0.5% coverage.
Closing it adds 0.2% coverage.
OWASP ZAP is already in your stack and says it can do this.Open
Closing it adds 0.2% coverage.
Checkov is already in your stack and says it can do this.Open
Closing it adds 0.2% coverage.
Closing it adds 0.2% coverage.
Closing it adds 0.2% coverage.
Checkov, Kyverno, Microsoft Defender for Cloud, Trivy are already in your stack and say they can do this.Open
Closing it adds 0.2% coverage.
OWASP ZAP is already in your stack and says it can do this.Open
Closing it adds 0.2% coverage.
Closing it adds 0.2% coverage.
Checkov, GitHub Advanced Security, Semgrep, SonarQube, Trivy are already in your stack and say they can do this.Open
Closing it adds 0.2% coverage.
Closing it adds 0.2% coverage.
Closing it adds 0.2% coverage.
The control is there. These are settings on it, and they move effectiveness and maturity instead.
Closing it changes no coverage — it is already counted as covered.
GitHub Advanced Security, Semgrep are already in your stack and say they can do this.Open
