> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/coverage.md).

# Coverage

The **AppSec Coverage** page is the centralized interface for understanding and managing security scanner coverage across the application development ecosystem. The Coverage page visualizes which assets (VCS repositories, CI/CD pipelines, and container image repositories) are scanned by which security scanners, identifies coverage gaps, and enables direct action to close those gaps.

**Pillar Alignment**: ASPM (Posture and Orchestration); Coverage visibility, scanner gap analysis, and onboarding orchestration across the SDLC.

## Core benefits and use cases

* **Reduce coverage gaps and visibility:** Eliminate blind spots by aligning discovered assets with active scanners
  * Identify onboarded vs. partially onboarded VCS and third-party integrations
  * Monitor SAST, SCA, Secrets, IaC, and Malware scanner active status across the codebase
* **Onboarding and maturity acceleration:** Direct scanner activation and asset onboarding to improve security posture
  * Evaluate stage-specific maturity to enable targeted improvements at each phase of the SDLC
  * Understand global and application-specific security scores to prioritize onboarding efforts
* **Compliance, guardrails, and health:** Ensure scanners are functional and policies are enforced for audit readiness
  * Verify which security policies and guardrails are applied and assess their effectiveness
  * Surface scan failures to prevent false confidence in compliance metrics

## Prerequisites

Before using the AppSec Coverage page, verify the following:

* **Cortex Cloud license**: An active Cortex Cloud license with Application Security entitlement
* **RBAC role**: AppSec Practitioner role for full access (view and edit). DevSecOps and Developer roles have view-only access
* **Data Sources Configured**: At least one VCS, CI/CD, or container registry data source onboarded to Cortex Cloud
* **Scanners enabled**: At least one security scanner (integral or third-party) activated on onboarded asset

## RBAC permissions  

| Role                    | Access coverage page | View coverage data | Configure scanner relevancy | Onboard assets | Activate scanners |
| ----------------------- | -------------------- | ------------------ | --------------------------- | -------------- | ----------------- |
| **AppSec Manager**      | Full access          | Yes                | Yes (define requirements)   | Yes (delegate) | Yes (delegate)    |
| **AppSec Practitioner** | Full access          | Yes                | Yes                         | Yes            | Yes               |
| **DevSecOps Engineer**  | View only            | Yes                | No                          | No             | No                |

**IMPORTANT:** Only AppSec Practitioners can modify scanner relevancy, onboard assets, or activate scanners from the Coverage page. DevSecOps engineers see action buttons grayed out with a **no permission** indicator. Developers cannot access the Coverage page.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/coverage.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.