Reference
Attack coverage
What classes of threats the Console can detect and what it deliberately does not do.
In scope
- External attack surface and exposure.
- Vulnerability and CVE scanning, SBOM, dependency analysis.
- Configuration and hardening audits.
- Secrets and credential exposure detection.
- Web app and API testing (authn, authz, IDOR, SSRF, injection).
- Network and infrastructure reconnaissance.
- AI agent abuse: prompt injection, jailbreaks, tool misuse, data exfiltration.
- Log and behavioural anomaly detection.
- Compliance posture mapping.
Not in scope
- Physical penetration testing.
- Adversarial activity against signalling or safety-critical OT.
- Anything that would require write access to operational systems.