A worked example. Nothing here belongs to you — start your own assessment to see yours.
198 weight covered221 weight not covered
Do we have the necessary security controls everywhere we need them?
Are those controls actually effective, or do scanners just run alongside?
Has this become a governable, measurable, continuously improved process?
What each tool is carrying, heaviest first.
A tool is the last link in the chain: it never decides coverage, it only turns up where an implementation already covers something.
3 unused capabilities you have gaps innothing else you own does this jobOpen
1 capability it has that you do not usenothing else you own does this jobOpen
1 unused capability you have a gap inalso done here by SemgrepOpen
3 unused capabilities you have gaps innothing else you own does this jobOpen
2 unused capabilities you have gaps innothing else you own does this jobOpen
nothing else you own does this jobOpen
nothing else you own does this jobOpen
2 unused capabilities you have gaps inalso done here by SonarQubeOpen
1 unused capability you have a gap innothing else you own does this jobOpen
2 unused capabilities you have gaps innothing else you own does this jobOpen
nothing else you own does this jobOpen
2 unused capabilities you have gaps innothing else you own does this jobOpen
