Component Vulnerability Analysis

Portfolio-level component risk analysis

{# Pareto Chart panel — top risk components by composite risk score with cumulative percentage on a secondary axis. Gate on labels length (not the whole dict's length, which counts keys, not rows — round-1 M1-11). #} {% if chart_data.pareto_chart is mapping and (chart_data.pareto_chart.get('labels', []) | length) > 0 %}

{{ fs.panel_head("Top risk components", meta="Pareto analysis") }}

Components sorted by composite risk score with cumulative risk percentage. Shows which components contribute disproportionately to total risk.

{% if render_mode == 'fragment' and not fragment_scripts_enabled %}

{{ server_svgs.get('pareto_chart', '

Chart unavailable in fragment view

') | safe }}

{% else %}

{% endif %}

{% endif %} {# Bubble Matrix panel — risk vs scope visualization. Gate on data array length (not the dict's outer length). #} {% if chart_data.bubble_matrix is mapping and (chart_data.bubble_matrix.get('data', []) | length) > 0 %}

{{ fs.panel_head("Component risk vs project scope", meta="bubble size = finding count") }}

Bubble chart showing risk score vs number of affected projects. Bubble size represents finding count.

{% if render_mode == 'fragment' and not fragment_scripts_enabled %}

{{ server_svgs.get('bubble_matrix', '

Chart unavailable in fragment view

') | safe }}

{% else %}

{% endif %}

{% endif %} {# Executive Summary narrative — preserves the pre-migration prose verbatim. Static content; no template variables. #}

Executive Summary

The Component Vulnerability Analysis provides a strategic portfolio-level view of the most problematic components across your entire organization. This report identifies which component versions pose the highest risk and have the broadest impact, enabling portfolio-wide component risk prioritization.

Key Insights from Visualizations

Pareto Analysis: Shows which components contribute disproportionately to total risk, with each version treated uniquely for precise risk assessment.
Risk vs. Scope: Identifies components with both high risk and broad project impact for maximum remediation efficiency.
Normalized Risk Scoring: Risk scores are normalized by project count to provide fair comparison across components used in different numbers of projects.

Strategic Recommendations

High-Risk Components: Focus immediate remediation efforts on components with the highest normalized risk scores.
High-Impact Components: Prioritize components affecting multiple projects for maximum portfolio-wide risk reduction.
KEV and Exploit Flags: Components with 🔒 (KEV) or 💥 (exploit) markers require immediate attention due to federal guidance and active threats.
Portfolio Management: Use this report to inform strategic component selection and vendor partnerships.

{# Portfolio-Level Component Risk Data table. #} {% if portfolio_rows and (portfolio_rows | length) > 0 %}

{{ fs.panel_head("Portfolio-level component risk data", meta=((portfolio_rows | length) | string) ~ " component" ~ ("s" if (portfolio_rows | length) != 1 else "")) }}

{% for row in portfolio_rows %} {% if row is mapping %} {% set pcr = row.get('portfolio_composite_risk', 0) | int %} {% set nrs = row.get('normalized_risk_score', 0) | int %} {% endif %} {% endfor %}

Component Name	Version	Projects Affected	Portfolio Composite Risk	Normalized Risk Score	Findings Count	Has KEV	Has Exploits
{{ row.get('name', '') }}	{{ row.get('version', '') }}	{{ row.get('project_count', 0) }}	{{ pcr }}	{{ nrs }}	{{ row.get('findings_count', 0) }}	{% if row.get('has_kev') %}🔒{% else %}—{% endif %}	{% if row.get('has_exploits') %}💥{% else %}—{% endif %}

{% else %}

No portfolio data available.

{% endif %}