> For the complete documentation index, see [llms.txt](https://docs.xygeni.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.xygeni.io/xygeni-products/application-security-posture-management-aspm/governance/governance-user-interface-guide.md).

# Governance User Interface Guide

### Security Posture

The **Security Posture** tab **r**eflects the cumulative severity of findings from all integrated scanners. Within the Security Posture Tab you can find the following details:

**Risk Score**

* A simplified risk indicator (color-coded).
* Reflects the cumulative severity of findings from all integrated scanners (SAST, SCA, Secrets, etc.).

**Risk Sources Breakdown**

A stacked bar showing the proportion of risk types found in the repository:

* **SAST** (e.g., insecure code patterns)
* **CI/CD** (pipeline misconfigurations)
* **SCA** (vulnerable open-source packages)
* **Secrets** (hardcoded keys/tokens)
* **IaC** (misconfigured infrastructure-as-code)
* **Malware** (malicious packages or files)
* **Anomalous Activity** (behavior-based risk)

Each segment reflects the volume of findings per category.

Issues Panel

* **Current Detected Issues**:
  * 🟥 Critical
  * 🟧 Medium
  * 🟨 Low
* **Trend Graph**:\
  Shows issue growth over time.
* **SCM Insights**:
  * Commits analyzed from GitHub.
  * Code-level issues broken down by severity.
* **Package Manager**:
  * Packages scanned — Security issues detected.
* **CI/CD**:
  * Pipelines and plugins detected/configured — no issues.
* **AppSec Policy**:
  * Security policies that have not been enforced or are misconfigured.
* **Deployment/Provisioning**:
  * IaC misconfigurations such as Kubernetes resources analyzed.

### Compliance Coverage

* **Standard:** **CIS SSC Security Guide**
* **Failed Checks**:
  * Examples: No protected branches, missing secure build tasks.
* **Passed Checks**:
  * Examples: Dependency pinning, approved build tools.

This helps gauge readiness for supply chain audits or regulatory compliance.

<figure><img src="/files/Mfy6LrFeqbhmA73Ah8qA" alt=""><figcaption></figcaption></figure>

### Trends

The **Trends** tab displays statistics regarding your projects vulnerabilities over a specified time period. The details shown in the Trends tab include:

* **New vs Resolved Issues** (color-coded):
  * New Issues Detected
  * Resolved Issues
* **Exposure Window** & **Time to Resolve**:
  * Marked as “Not Applicable” — likely due to a lack of remediation events.
* **Impact of Anomalous Activities**:
  * Visual markers for:
    * Critical file changes
    * Suspicious events<br>

<figure><img src="/files/nrbaAvLlQ4hFIlgOHZJq" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.xygeni.io/xygeni-products/application-security-posture-management-aspm/governance/governance-user-interface-guide.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.