Dashboard

The Dashboard is your organization's home — a roll-up across every project so you can see posture at a glance and spot where to look next.

Vulnerability posture

The headline: open findings broken down by severity (critical / high / medium / low), how many are fixable (a fix is available), and how many are VEX-suppressed (triaged as not affected, so they don't inflate the count). A per–BOM-type breakdown shows where risk concentrates across software, hardware, crypto, and AI/ML BOMs.

Each vulnerability counts once across the organization, however many projects or components it affects. How we count explains every total and why, for example, the Projects page can show a higher number.

Management view

Management view (the button at the top of the dashboard, or /organizations/{org}/overview) is one printable page for the people who need to see that the organisation is in control: where it stands (open vulnerabilities, critical and high, fixable, decided, identified), how it moves (the posture trend), what was done this month (decisions, including how many an agent recorded, rules, exclusions, edits, scans, uploads, findings resolved by rescans), what is next, compliance per framework, the licence verdict and the evidence bundles issued. Every number links to the page that backs it, and all numbers come from one endpoint that composes the same functions the detail pages use, so nothing on the page differs from the details. ?lang=nl renders it in Dutch; print it with the browser. Agents get the same composition from management_summary.

Next

Next is the queue of what to do, highest expected effect first: the upgrades that resolve the most vulnerabilities, critical or KEV vulnerabilities with no fix that need a decision, parts that were never identified or carry a CPE that matches nothing, rules awaiting approval, VEX decisions expiring within 14 days, BOMs older than 60 days, and projects never scanned or without a BOM. Every action links to the place to act.

The queue is computed from the current state each time, so a completed action disappears by itself. Snooze hides an action for seven days; Done hides it for 30 days and it returns if the condition persists. The marks are shared: an agent sees and sets the same ones through the MCP tools next_actions and set_next_action_state. The full queue, with snoozed and done actions on request, is under All actions.

Posture over time

Posture over time shows whether things are improving: open vulnerabilities by severity per day, and the change from the first to the last day in open, Critical plus High, KEV, the share decided by VEX and the share of parts with a usable identifier. The numbers come from snapshots taken for every project once a day and at the end of every scan; a snapshot holds exactly what the dashboard computed that day, so "today" on the chart equals the cards above it.

A member sees the trend of the projects they can open; private projects they are not a member of are left out, as everywhere else. Agents get the same series from the MCP tool posture_trend, and the REST endpoint GET /organizations/{org}/dashboard/posture-trend?days=90 returns it with a summary and the rule it was computed by.

The chart appears from the second day with data.

Activity

Activity is the ledger: VEX decisions, applicability rule changes and approvals, finding exclusions, part edits and identifier overrides, scans, BOM uploads and finding lifecycle events, newest first, each with who did it and through which client. A decision recorded by an agent through the MCP connector is marked agent; one made with an API token is marked API. Project-scoped rows cover the projects you can open. Agents read the same ledger with activity_feed, and the REST endpoint GET /organizations/{org}/activity pages it with before.

Coverage & alerts

Risk you can't see is the most dangerous kind, so the dashboard surfaces coverage gaps directly:

• Projects with no SBOM — nothing to scan yet.
• Has SBOM, not scanned — ingested but awaiting a scan.
• Unscanned projects — overdue for a fresh scan.

These are the first things to clear when you onboard.

Concentration risk & blast radius

• Concentration risk highlights components you depend on most widely — the ones whose next vulnerability would hurt the most.
• Blast radius answers the reverse: for a given vulnerability, how many projects it touches — so you can size an incident instantly.

Scan activity & recent projects

A timeline of recent scan activity and your most recently active projects, so you can jump straight back to wherever work is happening.