docs/plan/18 § assessments · CyberCloud.Security/assessments · M3 · 1.5 EM.
Trivy + kube-bench + our own resource-shape rules, surfaced as a score. The catalogue's note is the right scoping instinct: a thin version of this is worth more than nothing.
⚠ "Our own resource-shape rules" is the same evaluator as #M3-policy, for the third time (policy, conditional access, posture). Building three rule engines is how they come to disagree; building one with three subjects is the version that stays true.
Related: #17 — the licence scan does not exist and bundle images are pinned by tag rather than digest. Posture that reports on tenant resources while the platform's own supply chain is unscanned is a score with an asterisk.
docs/plan/18 § assessments ·
CyberCloud.Security/assessments· M3 · 1.5 EM.Trivy + kube-bench + our own resource-shape rules, surfaced as a score. The catalogue's note is the right scoping instinct: a thin version of this is worth more than nothing.
⚠ "Our own resource-shape rules" is the same evaluator as #M3-policy, for the third time (policy, conditional access, posture). Building three rule engines is how they come to disagree; building one with three subjects is the version that stays true.
Related: #17 — the licence scan does not exist and bundle images are pinned by tag rather than digest. Posture that reports on tenant resources while the platform's own supply chain is unscanned is a score with an asterisk.