Overview reference
Use Overview at /app/overview to see your organization’s Production
posture and decide which dependency updates to investigate first.
Last verified on October 28, 2026.
Scope and header
Section titled “Scope and header”The heading is Overview · followed by the organization name. If that name is unavailable, it shows Organization unavailable. The line above it shows Production, the number of applications, and the number of distinct sources. The application count includes the loaded applications; the source count counts distinct sources attached to their Production environments, including sources whose results are unavailable. Neither count means that scans succeeded.
Production totals combine shared sources and count each finding occurrence once, even when several applications use it. This is not a count of unique CVE identifiers: separate occurrences can refer to the same advisory. A finding accepted in every relevant context is excluded from open totals; accepting it in one environment does not remove it from other open contexts.
Open counts and priorities use results available for action: current complete results, complete results being refreshed, or reusable results within a failure grace period. Failed, unscanned, detached, unsupported and moved-tag sources cannot establish a clean Production total. Results retained during grace are older evidence, not evidence that the latest attempt succeeded.
Viewers can read the screen. Members and administrators also see Scan all and applicable source-repair links. See Manage applications and shared sources for Production configuration.
Scan all
Section titled “Scan all”Scan all queues scans for active repositories across the organization. Its scope is broader than the Production indicators on this page. The button’s availability on Overview depends on there being at least one distinct Production source, your role, the current request, and the organization scan quota.
- Members and administrators can use it; viewers do not see it.
- It is disabled while queueing, when no Production source is counted, or when the quota disallows another organization scan.
- Starter allows one organization scan every 24 hours. When provided, Next available shows the next permitted time in UTC, to the minute.
- An allowed retry of an incomplete organization scan is labeled Retry scan. While the request is pending, the label is Queueing….
On success, Scan all queued reports how many repositories were queued, or No active repositories to scan. A queued scan is not a completed scan: verify the resulting source status and result dates before relying on new totals.
The Starter time quota produces Scan all unavailable with the limit and, when known, the next available time. Other refusals, such as reaching the tracked-branch limit, and request errors produce Scan all failed with the returned error, or Unknown error. A failed request does not confirm that new results exist. Overview provides no cancellation or undo for a queued scan. Scanning updates analysis results; it does not apply dependency updates or open pull requests.
Read the indicator tiles
Section titled “Read the indicator tiles”These indicators use the loaded Production source data, not a live inspection of your running software. Their freshness depends on the underlying scans and recorded advisory signals. Overview does not show a separate refresh date for each exploit signal. Nonzero counts can be incomplete when some sources are unavailable.
When any Production source cannot verify a zero, zero values in Open findings, SLA, Known exploited, and the Fix now count become —, even beside nonzero values. The explanation is Not verified: some Production sources were not fully scanned or have no advisory coverage. This also applies to inventories with LuaRocks or git product-pin targets. A dash is unknown, not zero.
Portfolio posture · Production
Section titled “Portfolio posture · Production”Portfolio posture · Production shows a whole-number score from 0 to 100; higher is better. It is calculated for the union of Production sources, rather than by averaging application scores. The ring represents that same score.
The calculation starts at 100 and subtracts rounded, saturating penalties:
| Factor | Input | Maximum penalty |
|---|---|---|
| Exposure | Open findings weighted by severity: critical 10, high 4, medium 1, low 0.2; informational findings add no weight | 60 |
| Exploitability | The same severity weights, restricted to findings with KEV or public-exploit evidence | 20 |
| Remediation lag | Number of open security updates more than 30 whole days old (31 days or more) | 20 |
For exposure and exploitability, the penalty is the rounded value of
maximum × (1 − exp(−weight / K)), where K = 10 / −ln(0.75).
For remediation lag, it is round(20 × (1 − exp(−count / 3))).
Missing or invalid update detection dates contribute zero days when age is
derived from those dates. Penalties are not normalized by package count.
Hard caps then limit the score to 84 with an open critical finding, 74 with an open KEV finding, and 59 with a critical SLA breach. If several caps apply, the lowest wins. A cap is a maximum, not a score awarded automatically.
| Score | Label |
|---|---|
| 90–100 | Excellent |
| 75–89 | Good |
| 60–74 | Watch |
| 40–59 | At risk |
| 0–39 | Critical |
The caption can show Results dated, the reason supplied with the score, and blockers to the next band. Stale means the scan timestamp used for scoring is more than seven days old; exactly seven days does not trigger it. A missing or invalid timestamp does not trigger the badge, so its absence is not proof of freshness. The badge does not itself lower the numeric score.
When no complete score is supplied, the tile shows Score unavailable, not a partial score or zero. The caption explains the reason when available. A last complete score and date may appear if history contains one for the same Production scope; a score from a different scope is not reused. Scoring also requires a positive package count. A high score is not proof of complete vulnerability coverage or absence of risk.
Overview does not display a seven-day delta, trend chart, or direction arrow. The dated last-complete value is historical context, not a displayed trend.
Open findings
Section titled “Open findings”Open findings counts distinct open Production occurrences. The whole-number total includes informational findings. The breakdown runs from critical to low, with an additional informational count when nonzero. Severity is taken from open contexts; when copies disagree, the highest open severity wins. The severity bar is a distribution, not a risk score.
Coverage unavailable can appear when a source is failed, pending its first usable result, or detached. Other coverage gaps can still turn zeros into — without this exact warning. A numerical zero is not a general guarantee that the software is safe.
Select the total to open Production findings. This only navigates; it changes no finding or risk decision. Return to Overview to leave that view.
SLA counts open findings against remediation deadlines. Its main number is overdue, with due within 7 days and on track below. These are counts, not percentages; the bar shows their relative proportions.
Overview derives a critical finding’s deadline from its first-seen date and the shortest critical SLA among its open environments. A missing or invalid policy defaults to seven days. A deadline in the past is overdue; a deadline from now through seven days away is due soon. Other findings, and critical findings without a valid first-seen date, fall into on track. Thus on track does not prove that every finding has a verified deadline. These buckets are calculated from the loaded records and the current time when the screen is built.
Known exploited
Section titled “Known exploited”Known exploited displays three counts of distinct open findings:
- KEV: a recorded Known Exploited Vulnerabilities flag, identified as CISA KEV in the priority explanation.
- exploits: a recorded public-exploit flag.
- findings with exploit probability above 50%: a valid EPSS value strictly greater than 0.5 and no greater than 1. EPSS is a probability signal, not the risk score.
Open contexts combine positive exploit flags and take the highest valid EPSS value. The same finding can contribute to all three counts; do not add them as if they were disjoint groups. Missing flags do not count as positive, and missing or invalid EPSS does not qualify. Absence from a count does not prove that exploitation is impossible.
Priorities and rank explanations
Section titled “Priorities and rank explanations”Next best action displays the first open Production update and its position, #1 of the open update total. An update is a proposed version change, so this total is different from the number of findings.
The order is Fix now, then Plan, then Monitor, followed by descending numeric Rank within a category. Equal ranks use a stable identifier order. For a shared update, Overview uses the most urgent open category and the highest rank across open contexts. The displayed repository, branch or tag, environment, and shared-application text identify where the proposal applies.
Rank is a priority on a 0–100 scale, displayed rounded to the nearest integer. A missing rank shows as zero. Risk is the risk score, also rounded for display; it is distinct from rank and is not an attack probability. The next-action card omits a missing risk score; Fix now rows default a missing or invalid risk score to zero. Their risk bar is clamped to 0–100. Both values come from loaded analysis and context, rather than a new calculation performed by the Overview card. See Understand scan results and priorities for scoring concepts.
The card shows the package, current and proposed versions, and available reasons: Actively exploited for KEV evidence, otherwise Public exploit for public exploit evidence; Runs in production with application names; and an exploit probability when a valid positive EPSS value exists. The probability is rounded to a whole percent, with <1% exploit probability when rounding would give zero. That reason also identifies a direct or transitive dependency and counts distinct related open advisories. Missing signals are omitted, not evidence against exploitation.
Fix now previews at most six additional updates in that category. Its count includes the first update when it is already in Next best action, but the preview does not repeat it. Row numbers retain positions in the full ordered list. On small screens the table becomes stacked rows.
- Why this rank? opens the selected update’s rank explanation in its application and Production environment. It does not rerank or change it.
- Selecting a package in a Fix now row opens its update details; the package name in Next best action is not a link. View the queue opens the Production queue, including updates beyond the preview. These links only navigate; return to Overview without undoing a data change. Destination error handling is outside this screen.
- Copy command, when a suggested command exists, writes it to your clipboard. Success shows Copied and Command copied. If the clipboard is unavailable or the write fails, Could not copy the command. Select and copy it manually. appears. Copying does not execute the command or change dependencies. You can replace the clipboard contents; Overview has no clipboard undo.
Perpensa does not apply updates or open pull requests. Review the proposal, make the change in your development workflow, then verify it with a scan as described in Remediate a vulnerability and verify the fix.
Perpensa Rank
Section titled “Perpensa Rank”Rules set the category. Perpensa Rank refines the order within it on Pro and Team; Starter uses rules. The badge’s tooltip starts with Ranked by Perpensa AI. An update badge requires an accepted refinement contributing to that update’s rank. It can appear while other linked findings are still being reviewed; it is not an accuracy guarantee or a separate risk score.
On Pro and Team, Rules can indicate that review kept the order, is in progress, or was unavailable. Its tooltip distinguishes these states when provided. A missing refinement or a plan without included ranking shows no ranking-status mark; absence of the badge alone does not identify an error. The supplied refinement is checked for freshness before display; Overview does not show a review timestamp.
While Production findings have contexts under review, Pro and Team show a message such as Perpensa AI is still reviewing 2 findings. Rules set the order meanwhile. Each finding counts once even if several contexts are under review. The message disappears when none are under review. It is a processing status, not a scan-progress percentage or a completion-time estimate.
Supporting panels
Section titled “Supporting panels”Biggest win
Section titled “Biggest win”Biggest win shows the share of summed risk scores represented by up to two open Production updates with the largest positive risk scores and at least one related open advisory. everything else groups the remaining qualifying updates. Whole-number shares use rounding that allocates the remainder so they total 100%; zero-percent segments are omitted. The headline sums the named updates’ displayed shares.
Despite the label of your risk, this is a distribution of update scores, not a percentage reduction in real-world risk, a posture-score forecast, or a different priority order. It uses the loaded updates; missing, invalid and nonpositive scores do not contribute. The panel is absent when none qualify.
Needs attention
Section titled “Needs attention”Needs attention lists Production configuration and scan problems: no repository, failed or archived sources, moved tags, failure grace, detached sources with historical results, pending scans, or another score-unavailability reason. Critical issues appear before warnings and muted statuses. The panel is absent when there are no rows; that absence is not a coverage certificate.
Available dates behind relative status text are exposed on hover and to assistive technology in UTC, including Last complete scan, Last successful scan, Last attempt, and Grace ends. Missing or invalid dates are omitted. Relative times are rounded down. A failed attempt and the dated results it leaves available are separate facts.
For members and administrators, Reconnect opens the repository connection flow for an eligible failed source or a source in grace; archived failures do not offer it. Review the new commit opens the application for a moved tag. Attach source opens the application when Production has no repository. Applications and application names navigate to their respective pages. These links do not themselves reconnect, accept a commit, or attach a source; you can return without changing configuration. Overview does not report the outcome or errors of later configuration steps. After completing those steps, verify the source status and score; see Applications.
Applications · Production
Section titled “Applications · Production”Applications · Production lists available application scores on the same 0–100 posture scale, Lowest score first. With multiple scored Production environments, it shows the lowest available score and names that environment; it does not average them. Environments without a score are omitted from this selection, so the row alone does not prove complete application coverage.
The subtitle normally counts distinct repositories across the scored Production environments. During failure grace it can instead show result age and grace expiry. Available source dates and Score captured are exposed in UTC on hover and to assistive technology. These are stored results, not a fresh scan triggered by viewing the row. If no application has a usable Production score, the panel says No Production score yet. Select an application name to inspect its configuration; navigation itself changes no data.
Outside production and Base images
Section titled “Outside production and Base images”Outside production, marked Not in the scores, lists non-production application environments with open findings or coverage/tag warnings. Counts are deduplicated within each listed environment; shared findings can appear in several rows, so these rows are not a portfolio total. They use the same loaded scan evidence and severity categories. Missing counts are omitted. The panel does not list every clean non-production environment. Application links and, for members and administrators, Review the new commit navigate without changing data.
Base images appears when usable Production inventory contains base-image assessments with priority signals. It lists image/support warnings, affected applications and repositories, ordered by high, medium, then low signal severity. Ended-security-support groups show Support ended and Replace; Replace is a status label, not a button. These signals come from the loaded inventory assessments, not the finding counters. Missing or invalid assessments are omitted, and this panel shows no assessment timestamp. Its absence does not prove every image is supported or free from vulnerabilities.
Loading, empty states and limits
Section titled “Loading, empty states and limits”- Loading Overview… appears while application data loads. Header counts during loading are not verified scan totals.
- A load failure displays the returned error. It does not show the normal no-applications message as a successful empty result.
- No applications yet. offers Configure Production, which opens Applications. Navigation itself creates nothing; a member or administrator must perform the configuration.
- Without an eligible update, Next best action says No open Production updates. With unverified coverage it instead says Production results are incomplete, so no update can be listed yet.
- Without a Fix now update, the normal message is No Fix now updates in Production. When other priorities exist but coverage is incomplete, it says No Fix now update found, but Production results are incomplete. An empty preview can also mean its only update is already in Next best action.
Overview summarizes available evidence. A missing score, dash, absent panel, or empty queue must not be read as proof that Production has no vulnerabilities. Check the source configuration, result dates and warnings before treating a count or priority as complete.