Risk scoring
An inventory that flags everything as equally urgent is not actionable. Each finding is scored on four axes. Why this matters: Migration work has finite capacity. Scoring turns a CBOM into an ordered backlog.Axes
- Algorithm vulnerability — broken outranks weakened outranks safe.
- Data longevity (HNDL exposure) — the longer a secret must hold, the higher the harvest-now-decrypt-later risk.
- Exposure surface — internet-facing vs. internal; in-transit vs. at-rest vs. code-signing.
- Crypto-agility — a hardcoded primitive costs more to remediate than one behind a provider interface.
--fail-on.