An application risk view
A service-level starting point with its member repositories and uploaded findings, so the security team can ask a specific owner for a specific action.
Enterprise security programmes
See the repositories as applications your organisation owns.
Security leaders need to know which services need attention, who can act and whether the evidence is current. Code Security brings uploaded findings and inventories into an application-centred review, with SLA policy and governance records that help coordinate remediation.
Application
Customer checkout
One service owner. Evidence from each participating repository.
- Web frontendSource findings & dependencies
- Payments APIFindings, dispositions & due dates
- InfrastructureConfiguration & delivery checks
Example relationships, not a customer dashboard. Repository membership is configured by your team.
A practical scenario
A newly relevant advisory affects a shared dependency
The same package may be used by several teams in services with different exposure and release schedules. A package name alone is not a remediation plan. Find the recognised versions, review the associated repositories and involve the owners of the affected applications.
- Bring to the review
- Uploaded repository scans and inventories, application membership, responsible owners and the organisation's remediation policy.
- Work towards
- A scoped set of affected services, assigned work and a subsequent scan that can verify the change.
The team's working process
Build a portfolio that remains useful after the initial rollout
Connect repositories to accountable applications
Group the API, frontend, libraries and infrastructure repositories that belong to a service. Establish who maintains that relationship and how criticality and other application context will be kept current. Unmapped or stale repositories should remain visible as work to resolve.
Investigate exposure and set the response
Inspect inventory and advisory details, then review the findings in application context. Use SLA policy to set expectations and governance workflows for reviewed exceptions. A risk score supports ordering the work; the finding evidence explains the action.
Track progress with comparable evidence
Follow assignments, campaigns and acceptance expiry. Read severity trends and surface breakdowns with scan freshness so a drop in reported findings is not mistaken for remediation when coverage also fell. Verify changes through new scans and retain the decision history.
The result of the work
A useful handover between engineering and security.
An inventory-led response
Recognised package and version associations help determine which scanned repositories need investigation when an advisory becomes relevant.
A governance record
Risk reasons, SLA expectations, audit events and reports help reviewers understand who decided, why the work remains open and what verification is still needed.
A focused evaluation
Test the workflow with evidence your team already understands.
Start with several related repositories and one application owner. Populate the software inventory, define a remediation expectation and follow a real finding from discovery to verification. Include a stale or incomplete scan in the exercise to test how the team recognises missing evidence.
Agree the participating team, input scope and expected deliverable before expanding the rollout. The most useful evaluation shows how a real owner investigates and acts on the result.
Practical questions
Planning for enterprise security programmes.
Can we include repositories that only scan locally?
They remain outside shared portfolio views until their findings or inventories are uploaded. Plan the participating scope explicitly.
Are local risk labels organisation approvals?
No. Organisation roles, membership and governance decisions are enforced in the console. Local annotations cannot grant an exception or bypass a release gate.
Which plans provide these controls?
Business and Enterprise include application risk and the organisation inventory and governance features. Enterprise adds agreed deployment, licensing and contractual scope.
Code Security · next step
Start with one application and its repositories.
A scoped set of affected services, assigned work and a subsequent scan that can verify the change.
14-day self-service trial. Card required; cancel before the trial ends to avoid the first charge.