About This Report
Finite State provides comprehensive software supply chain security through automated binary analysis, vulnerability management, and compliance monitoring. Our platform identifies security risks in firmware, embedded systems, and software components.
This report provides a security risk summary for
{% if scan_metadata.get('project_name') %}{{ scan_metadata.get('project_name') }}{% endif %}
{% if scan_metadata.get('version_name') %} version {{ scan_metadata.get('version_name') }}{% endif %}.
It includes severity distribution, exploit maturity analysis, component risk rankings, and actionable remediation guidance.
Confidentiality Notice: This report is intended solely for the authorized recipient(s). It contains confidential security assessment data. Unauthorized distribution, copying, or disclosure is prohibited.
{% endif %}
{# Customer-facing header — preserves the pre-migration single
Security Brief
+ badges body. The PDF parity test's
`"Customer Brief"` section anchor is satisfied by the recipe name
appearing elsewhere in the document (title tag, topbar breadcrumb,
PDF header band) — NOT by an additional
in the body. Adding
a new Customer Brief
on page 2 broke parity in CI
(baseline had `[]` for that anchor; new render had `[2]`).
Round-3 multi-review parity-fix: restore pre-migration's body
outline verbatim. #}
{# ── Security Overview KPI bar ─────────────────────────────────────── #}
Security Overview
{% if summary %}
{# Row 1 — size + severity (descending). #}
{{ summary.get('open_count', 0) }}
Total Open
{{ summary.get('critical_count', 0) }}
Critical
{{ summary.get('high_count', 0) }}
High
{{ summary.get('medium_count', 0) }}
Medium
{{ summary.get('low_count', 0) }}
Low
{% if summary.get('other_count') and summary.get('other_count') > 0 %}
{{ summary.get('other_count') }}
Other
{% endif %}
{# Row 2 — exploitation indicators + posture. #}
{{ summary.get('kev_count', 0) }}
KEV Listed
{{ summary.get('exploit_count', 0) }}
With Exploits
{{ summary.get('total_components', 0) }}
Components
{{ summary.get('pct_triaged', 0) }}%
% Triaged
{% else %}
{% endif %}
Risk Overview
{% if sev_total > 0 %}
{% if (sev.get('CRITICAL', 0) | int) > 0 %}
{{ sev.get('CRITICAL', 0) }}
{% endif %}
{% if (sev.get('HIGH', 0) | int) > 0 %}
{{ sev.get('HIGH', 0) }}
{% endif %}
{% if (sev.get('MEDIUM', 0) | int) > 0 %}
{{ sev.get('MEDIUM', 0) }}
{% endif %}
{% if (sev.get('LOW', 0) | int) > 0 %}
{{ sev.get('LOW', 0) }}
{% endif %}
{% if (sev.get('INFORMATIONAL', 0) | int) > 0 %}
{{ sev.get('INFORMATIONAL', 0) }}
{% endif %}
{% if (sev.get('OTHER', 0) | int) > 0 %}
{{ sev.get('OTHER', 0) }}
{% endif %}
{% if (sev.get('CRITICAL', 0) | int) > 0 %}Critical ({{ sev.get('CRITICAL', 0) }}){% endif %}
{% if (sev.get('HIGH', 0) | int) > 0 %}High ({{ sev.get('HIGH', 0) }}){% endif %}
{% if (sev.get('MEDIUM', 0) | int) > 0 %}Medium ({{ sev.get('MEDIUM', 0) }}){% endif %}
{% if (sev.get('LOW', 0) | int) > 0 %}Low ({{ sev.get('LOW', 0) }}){% endif %}
{% if (sev.get('INFORMATIONAL', 0) | int) > 0 %}Informational ({{ sev.get('INFORMATIONAL', 0) }}){% endif %}
{% if (sev.get('OTHER', 0) | int) > 0 %}Other ({{ sev.get('OTHER', 0) }}){% endif %}
{% endif %}
{% endif %}
{# ── Top Findings (Critical + High, open) ──────────────────────────── #}
{% if top_findings %}
Top Findings (Critical & High, Open)
{% endif %}
{# ── Detailed Findings (PDF-only, detailed mode only) ──────────────── #}
{% if mode == 'detailed' and detailed_findings %}
Detailed Findings
{% for f in detailed_findings %}
{% if f is mapping %}
- Component
- {{ f.get('component', '—') }} {{ f.get('component_version', '') }}{% if f.get('component_description') %} — {{ f.get('component_description') }}{% endif %}
- Exploit Maturity
- {% if f.get('exploit_maturity') %}{% for em in f.get('exploit_maturity') %}🔥 {{ em }}{% endfor %}{% else %}None known{% endif %}
- Reachability
- {{ f.get('reachability_label', 'UNKNOWN') }}
{% if f.get('epss_percentile') %}- EPSS Percentile
- {{ "%.1f"|format((f.get('epss_percentile') | float) * 100) }}%
{% endif %}
{% if f.get('attack_vector') %}- Attack Vector
- {{ f.get('attack_vector') }}
{% endif %}
{% if f.get('cve_aliases') %}- CVE Aliases
- {{ f.get('cve_aliases') | join(", ") }}
{% endif %}
{% if f.get('description') %}
{{ f.get('description', '')[:500] }}{% if (f.get('description', '') | length) > 500 %}…{% endif %}
{% endif %}
{% if f.get('remediation') %}
Remediation: {{ f.get('remediation') }}
{% endif %}
{% if f.get('mitigation') %}
Mitigation: {{ f.get('mitigation') }}
{% endif %}
{% endif %}
{% endfor %}
{% endif %}
{# ── Top Security Risks (all severities) ───────────────────────────── #}
{% if top_security_risks %}
{% endif %}
{# ── Triage Status (server-rendered segmented bar) ─────────────────── #}
{% if triage_summary %}
Triage Status
{% set ts = triage_summary %}
{% set ts_total = (ts.get('untriaged', 0) | int) + (ts.get('in_triage', 0) | int) + (ts.get('not_affected', 0) | int) + (ts.get('false_positive', 0) | int) + (ts.get('affected', 0) | int) + (ts.get('resolved', 0) | int) %}
{% if ts_total > 0 %}
{% if (ts.get('untriaged', 0) | int) > 0 %}
{{ ts.get('untriaged', 0) }}
{% endif %}
{% if (ts.get('in_triage', 0) | int) > 0 %}
{{ ts.get('in_triage', 0) }}
{% endif %}
{% if (ts.get('not_affected', 0) | int) > 0 %}
{{ ts.get('not_affected', 0) }}
{% endif %}
{% if (ts.get('false_positive', 0) | int) > 0 %}
{{ ts.get('false_positive', 0) }}
{% endif %}
{% if (ts.get('affected', 0) | int) > 0 %}
{{ ts.get('affected', 0) }}
{% endif %}
{% if (ts.get('resolved', 0) | int) > 0 %}
{{ ts.get('resolved', 0) }}
{% endif %}
Untriaged ({{ ts.get('untriaged', 0) }})
In Triage ({{ ts.get('in_triage', 0) }})
Not Affected ({{ ts.get('not_affected', 0) }})
False Positive ({{ ts.get('false_positive', 0) }})
Affected ({{ ts.get('affected', 0) }})
Resolved ({{ ts.get('resolved', 0) }})
{% endif %}
{# ── Exploit Maturity (3x3 heat-coded grid) ────────────────────────── #}
{% if exploit_maturity_summary %}
Exploit Maturity
{{ exploit_maturity_summary.get('total_with_exploits', 0) }} finding(s) with known exploit intelligence
{% set cats = [
("kev", "In KEV"), ("vckev", "VulnCheck KEV"), ("weaponized", "Weaponized"),
("poc", "PoC"), ("threatactors", "Threat Actors"), ("ransomware", "Ransomware"),
("botnets", "Botnets"), ("commercial", "Commercial"), ("reported", "Reported")
] %}
{% for key, label in cats %}
{% set count = exploit_maturity_summary.get(key, 0) | int %}
{% if count > 10 %}{% set heat = "cb-heat-3" %}
{% elif count > 3 %}{% set heat = "cb-heat-2" %}
{% elif count > 0 %}{% set heat = "cb-heat-1" %}
{% else %}{% set heat = "cb-heat-0" %}{% endif %}
{% endfor %}
Reachability Analysis
{{ reachability_summary.get('reachable', 0) }}
Reachable
{{ reachability_summary.get('unreachable', 0) }}
Unreachable
{{ reachability_summary.get('inconclusive', 0) }}
Inconclusive
{% endif %}
{# ── Component Risk Analysis ───────────────────────────────────────── #}
{% if component_risk_ranking %}
{% endif %}
{# ── Component Licenses (the ONLY ECharts chart in this recipe) ────── #}
{% if component_license_distribution %}
Component Licenses
{% if render_mode == 'fragment' and not fragment_scripts_enabled %}
Chart unavailable in fragment view
{{ components_missing_license }} additional component{% if components_missing_license != 1 %}s{% endif %} not shown — no license metadata recorded in the SBOM.
{% endif %}
{% endif %}
{# ── Vulnerable Components (Gate 1 / Gate 2 highlights) ────────────── #}
{% if remediation_highlights %}
Vulnerable Components
Gate 1 — Reachable + Exploitable/KEV
{% set _g1 = remediation_highlights.get('gate_1', []) %}
{% if _g1 and _g1 is iterable and _g1 is not string %}
{% for card in _g1 %}
{% if card is mapping %}
{{ card.get('component', '—') }}
{{ card.get('finding_count', 0) }} finding(s) · Top CVE: {{ card.get('top_cve', '—') }} · CVSS {{ "%.1f"|format(card.get('worst_cvss', 0) | float) }}
{% endif %}
{% endfor %}
{% else %}
No Gate 1 findings identified.
{% endif %}
Gate 2 — Network Vector + High EPSS
{% set _g2 = remediation_highlights.get('gate_2', []) %}
{% if _g2 and _g2 is iterable and _g2 is not string %}
{% for card in _g2 %}
{% if card is mapping %}
{{ card.get('component', '—') }}
{{ card.get('finding_count', 0) }} finding(s) · Top CVE: {{ card.get('top_cve', '—') }} · CVSS {{ "%.1f"|format(card.get('worst_cvss', 0) | float) }}
{% endif %}
{% endfor %}
{% else %}
No Gate 2 findings identified.
{% endif %}
{% endif %}
{# ── SBOM Summary ──────────────────────────────────────────────────── #}
{% if sbom_stats %}
SBOM Summary
Total Components: {{ sbom_stats.get('total_components', 0) }}
{% endif %}
{# ── Scan Metadata ─────────────────────────────────────────────────── #}
{% if scan_metadata %}
Scan Metadata
{% if scan_metadata.get('project_name') %}Project: {{ scan_metadata.get('project_name') }}{% endif %}
{% if scan_metadata.get('version_name') %}Version: {{ scan_metadata.get('version_name') }}{% endif %}
{% if scan_metadata.get('scan_date_range') %}Detection Range: {{ scan_metadata.get('scan_date_range') }}{% endif %}
{% endif %}
{# ── PDF Glossary Appendix (anchor: "License", "Findings") ───────────
Gated on render_mode != 'fragment' so the glossary prose doesn't
leak into compound fragment bundles (round-1 multi-review M1-2
patch). The "License" section anchor inside this block is what
tests/test_pdf_parity.py asserts on for PDF parity. #}
{% if render_mode != 'fragment' %}
Glossary
Core Security Terms
- Risk Score
- A composite score (0–10) indicating the overall risk of a vulnerability, factoring in severity, exploitability, and reachability.
- Severity
- The CVSS-based classification of a vulnerability's potential impact: Critical, High, Medium, Low, or Informational.
- CVE (Common Vulnerabilities and Exposures)
- A standardized identifier for publicly known security vulnerabilities (e.g., CVE-2024-3094).
- EPSS (Exploit Prediction Scoring System)
- A probability score (0–1) predicting the likelihood a vulnerability will be exploited in the wild within 30 days.
- CVSS (Common Vulnerability Scoring System)
- An industry standard for assessing the severity of vulnerabilities on a 0–10 scale.
Component & Software Terms
- SBOM (Software Bill of Materials)
- A comprehensive inventory of all software components, libraries, and dependencies in a product.
- Component
- A discrete software package, library, or module identified in a product's SBOM.
- License
- The legal terms under which a software component may be used, distributed, or modified (e.g., MIT, GPL, Apache-2.0).
Exploit & Threat Terms
- KEV (Known Exploited Vulnerabilities)
- CISA's catalog of vulnerabilities confirmed to be actively exploited in the wild.
- Weaponized
- An exploit that has been packaged into a readily usable attack tool or framework.
- PoC (Proof of Concept)
- A demonstration exploit that proves a vulnerability can be exploited, but may not be weaponized.
- Threat Actors
- Vulnerabilities known to be targeted by specific threat groups or APTs.
- Ransomware
- Vulnerabilities known to be exploited by ransomware campaigns.
- Botnets
- Vulnerabilities exploited by automated botnet networks for mass compromise.
- Commercial
- Exploits available in commercial exploit marketplaces or tools.
- Reported
- Exploits that have been publicly reported but may not yet be weaponized.
Security Analysis Terms
- Reachability
- Whether a vulnerable code path can actually be reached during normal execution of the software.
- VEX (Vulnerability Exploitability eXchange)
- A standard for communicating the exploitability status of vulnerabilities in specific products.
- Triage
- The process of evaluating and prioritizing vulnerabilities based on risk, exploitability, and business impact.
- Attack Vector
- The method by which a vulnerability can be exploited: Network, Adjacent, Local, or Physical.
{% endif %}