DevSecOps Vulnerability & Compliance Lifecycle

Thornfield Digital · SOC2 Pipeline · 8 Services

Critical Open
23
+4 vs last week
MTTR Critical
8.4d
-1.2d vs target 5d
Risk Score
61
Exploitability-weighted
SLA Breach Rate
18%
By team this sprint
Image Age P90
41d
11 incidents in 2wk
Scan Coverage
93%
Target: 95%

MTTR by Severity (Last 12 Weeks)

Open vs Closed Vulnerabilities

SLA Breach Heatmap by Team

Sprint 7
Sprint 8
Sprint 9
Sprint 10
Auth Service
8%
22%
34%
28%
Billing API
5%
9%
26%
19%
Payments Gateway
4%
11%
14%
7%
User Profile
12%
18%
21%
15%
Analytics Engine
3%
6%
8%
5%
≤15% (OK)
16-24% (Warn)
25-29% (High)
≥30% (Critical)

Finding Source Mix

Image Age vs Risk Score

Top Exploitable CVEs (Last 30 Days)

CVE ID Service Severity CVSS Exploit Score Age (days) Status
CVE-2024-1234 Auth Service Critical 9.8 8.9 14 Open
CVE-2024-5678 Billing API Critical 9.1 8.5 21 Open
CVE-2024-9101 Payments Gateway High 8.6 7.8 9 Open
CVE-2024-1122 Auth Service Critical 9.3 8.2 6 In Progress
CVE-2024-3344 User Profile High 8.1 7.4 18 Open
CVE-2024-5566 Billing API High 7.9 6.8 12 Open
CVE-2024-7788 Analytics Engine Medium 6.5 5.9 27 Open
CVE-2024-9900 Payments Gateway High 8.4 7.1 5 In Progress

Compliance Control Pass Rate

SOC2 Audit Readiness

Additional Metrics

Secrets Exposure Incidents 2
IaC Policy Violation Rate 12%
Dependency Outdatedness Index 3.4
Policy Drift Events 7