skills/analyze-veda-demo/references/demo-evidence.json

{
  "boundary": "All records are synthetic demonstration data and are not production security advice.",
  "portfolio": {
    "organization": "Northstar Demo Holdings",
    "riskScore": 72,
    "riskTrendPercent": -11,
    "exposedAssets": 18,
    "criticalPaths": 3,
    "meanNeutralizationHours": 19,
    "controlCoveragePercent": 87
  },
  "vulnerabilities": [
    {
      "id": "CVE-2026-21987",
      "product": "FortiOS 7.2",
      "severity": "Critical",
      "epss": 0.96,
      "kev": true,
      "status": "Virtual patch active",
      "owner": "Network Security",
      "decision": "Restrict management-plane access and upgrade the HA pair to the approved fixed release."
    },
    {
      "id": "CVE-2025-55182",
      "product": "React Server Components",
      "severity": "Critical",
      "epss": 0.91,
      "kev": false,
      "status": "Fix scheduled",
      "owner": "Digital Commerce",
      "decision": "Upgrade the affected framework and validate server-action boundaries in staging."
    },
    {
      "id": "CVE-2024-23897",
      "product": "Jenkins LTS",
      "severity": "Critical",
      "epss": 0.94,
      "kev": true,
      "status": "Investigating",
      "owner": "Platform Engineering",
      "decision": "Disable CLI access, upgrade the controller, rotate secrets, and review access logs."
    },
    {
      "id": "CVE-2026-14812",
      "product": "Kong Gateway",
      "severity": "High",
      "epss": 0.72,
      "kev": false,
      "status": "Canary upgrade",
      "owner": "Integration Platform",
      "decision": "Normalize ambiguous transfer headers and complete the approved canary upgrade."
    },
    {
      "id": "CVE-2025-49704",
      "product": "SharePoint Server",
      "severity": "High",
      "epss": 0.88,
      "kev": true,
      "status": "Patched",
      "owner": "Workplace Services",
      "decision": "Retain patch evidence and monitor for post-exploitation indicators."
    },
    {
      "id": "CVE-2026-10377",
      "product": "Keycloak",
      "severity": "Medium",
      "epss": 0.23,
      "kev": false,
      "status": "Accepted window",
      "owner": "Identity Engineering",
      "decision": "Apply the maintenance release and invalidate pre-upgrade sessions."
    }
  ],
  "attackPaths": [
    {
      "id": "path-edge-to-commerce",
      "title": "Internet edge to customer data",
      "probability": 78,
      "impact": "Material",
      "state": "Interrupted",
      "nodes": ["Internet", "Primary internet firewall", "Digital commerce web tier", "Customer profile store"],
      "decision": "Keep the virtual patch enforced until the HA upgrade and credential rotation are verified."
    },
    {
      "id": "path-ci-to-production",
      "title": "Build controller to production deploy",
      "probability": 71,
      "impact": "Material",
      "state": "Open",
      "nodes": ["Developer account", "Shared build controller", "Deployment credential", "Production cluster"],
      "decision": "Disable CLI, isolate the controller, rotate deploy credentials, then rebuild from a trusted image."
    },
    {
      "id": "path-partner-to-orders",
      "title": "Partner API to order workflow",
      "probability": 43,
      "impact": "Moderate",
      "state": "Monitored",
      "nodes": ["Partner client", "API gateway", "Order orchestration", "Order database"],
      "decision": "Complete the gateway rollout and retain regression-test evidence before closure."
    }
  ]
}