Advisory

Overview

Main > Advisory turns your mapped architecture into security advisories. Each audit reads the asset graph built from your cloud and infrastructure integrations and produces an advisory: an overall risk level, a summary, and findings tied to specific assets, with recommendations.

There are two audit types:

Analyze attack path traces reachable paths from internet-exposed assets to sensitive data stores. Its advisories are labelled Attack Path Advisory.
Model threats generates a STRIDE-style threat model of your architecture. Its advisories are labelled Threat Modeling.

Home’s Review architecture recommendation links here when no audit has completed in 30 days.

Prerequisites

A role with assets:read (see Permissions).
A connected integration that supports architecture discovery, and a completed (or partial) architecture scan. See Assets and Architecture Graph.
A role with both scans:execute and org_settings:edit to start an audit. Of the built-in roles, only Administrator holds both.

How it works

While an audit runs, the advisory shows Running security audit and its current phase:

Attack path: Mapping assets & infrastructure, Enumerating attack paths, Analyzing security risks, Correlating findings & recommendations.
Threat model: Mapping assets & infrastructure, Modeling threats, Adjudicating findings.

One audit of each type runs at a time; an attack path audit and a threat model can run side by side. If your architecture has not changed meaningfully since the last successful audit of the same type, the new audit reuses those results and finishes at once. An audit that makes no progress for 30 minutes is marked as failed.

Audits do not run on a schedule and do not count against a usage allowance. An organization can start up to four audits in any 20 minutes. If your plan includes Agents, an audit that runs a fresh analysis also appears on Main > Agents under the Security advisory workflow.

Run an audit

Open Main > Advisory.
Click Run audit (shown before your first advisory) or Audit in the page header.
In Run a new audit, choose Analyze attack path or Model threats.
The new advisory opens with its progress. The header button reads In progress… meanwhile.

If the architecture changed after the newest advisory of a type, that advisory shows Results may be outdated. Click Re-run audit to start a fresh one.

Reviewing findings

Select an advisory in the sidebar, or press j/k (or the arrow keys) to move between them. The header shows the audit date, the audit type, the overall risk (Critical, High, Medium, or Low), and the finding count at each severity.

The report contains:

Overall posture, What was found, What is sound, and What should I do?
Analysis reasoning, a collapsed note on which findings were confirmed or downgraded, and why.
The findings list. Each card names the affected asset, its kind, and its severity; expand it for Summary, Details, and Recommendations.

Integration issues during this scan means some architecture integrations were broken (no API access) or degraded (partial access from insufficient permissions) when the audit started. Fix them under Admin > Integrations, then run a new audit.

To take results elsewhere:

Copy in the advisory header, and the copy button on each finding, offer Copy as Markdown, Copy as Prompt (for an AI assistant), and Copy as Ticket.
Copy link to advisory and Copy link to finding copy a link to the advisory or finding.
Helpful and Not helpful rate the advisory or a finding. Not helpful opens Help us improve for an optional note.

Saved advisories and history

The sidebar groups advisories into sections:

Currently viewing — the advisory a shared link opened, unless it is in Recent or Saved.
Recent — the newest advisory of each audit type.
Saved — advisories you bookmarked. Hover a row and click the bookmark icon (Save advisory); click it again to Remove from Saved.
History — every other advisory, newest first. More load as you scroll.

Saved advisories, and whether Saved and History are expanded, are stored in your browser per organization, so teammates and your other browsers do not see them. Failed audits are left out of the sidebar.

Permissions

Ability	Grants
`assets:read`	The Advisory link and page: viewing, saving, copying, and sharing.
`assets:edit`	Helpful and Not helpful feedback on advisories and findings.
`scans:execute` and `org_settings:edit`	Starting an audit: the Audit, Run audit and Re-run audit buttons.

Administrator holds all of them, so only administrators can start audits. Team Member holds assets:read, assets:edit and scans:execute, so members can view advisories and give feedback but not start an audit. Read Only holds assets:read only. Penetration Tester does not hold assets:read, so the page is hidden. In a custom role these are Asset Inventory View and Edit, Scans Run, and Organization Settings Edit. See Roles and Permissions.

Troubleshooting

Connect an integration to get started — Click Connect integration and connect a cloud or infrastructure provider.
Run an architecture scan first — Click Run architecture scan to open Main > Assets, then click Discover.
Architecture scan in progress — Audits become available once the scan completes.
You do not have permission to start an audit. — Your role lacks scans:execute or org_settings:edit. Ask an administrator to run the audit.
An audit is already in progress. — An audit of the same type is still running.
Too many audits started. Try again in a few minutes. — Your organization started four audits in the last 20 minutes. Retry once 20 minutes have passed since the first.
Failed to start audit. Please try again. — Any other error, such as no completed scan.
This scan failed to complete. — Start a new audit.
Advisory not found. — The link points to an advisory that is not in this organization.
Audit, Run audit or Re-run audit button missing — Your role lacks scans:execute or org_settings:edit, or no architecture scan has completed.