Assess scan coverage and health across the portfolio

Establish which repositories have never been scanned, and which have scans that did not finish, before drawing any conclusion from the findings the scans produced. This assessment spans two pages: the AppSec Coverage page establishes the repositories that have never been scanned, and the Branch Periodic Scans inventory establishes the repositories whose scans did not finish.

Prerequisites

• The Application Security Periodic View permission for the Branch Periodic Scans inventory, and access to the AppSec Coverage page
• Establish business application criticality: ordering before you begin. Identify and list your business applications in order of criticality, flagging the ones essential to your operations. Navigate to Application Security > Application Management > Business Applications, sort the table by the Business Criticality column, and record the application names in that order. Which criticality levels count as business-critical is a governance decision — confirm it with the AppSec Manager

Establish the repositories that never that have never been scanned

1. Navigate to Application Security > AppSec Coverage.
2. Scope the asset coverage table to VCS repositories: Apply the Asset Type filter and select Repository (The Coverage page reports repositories, CI/CD pipelines, and container image repositories together, and without this filter the returned population cannot be compared to the repository rows in the scan inventory).
3. Filter the scoped table by Last Scan Status and select Not Scanned Yet. These repositories have scanners switched on but have never been scanned, so they appear in no scan inventory row and contribute no findings. Record the count. Note: Do not use the Not Covered value on the Coverage by Status widget for this count. Not Covered means no scanner is switched on. Not Scanned Yet means scanners are switched on but nothing has run. A repository can be fully covered and never scanned at the same time, so the widget misses repositories you need.
4. Triage the returned repositories before proceeding. Apply the Business Application Names filter and select the business-critical applications from your list (see prerequisites). A large number of repositories immediately after a bulk scanner activation is expected and resolves within one scan cycle — see Configure repository scan coverage. A count that persists across more than one cycle indicates a scan execution failure rather than a configuration gap.
5. Verification: Confirm the Asset Type filter is set to Repository and the Last Scan Status filter is set to Not Scanned Yet before recording the count as final.

Establish the repositories whose scans did not finish

1. Navigate to Application Security > Scans > Branch Periodic Scans, and use the filter bar to filter by repository name, organization, scanned branch, scan health status, and scan date. Bound the assessment to the current cycle with the Scan Date filter, so the returned failures are the failures of the period under review rather than every failure the inventory has accumulated — see Scan Date filter.
2. Filter Scan Health to Error and to Partially (completed). The returned rows are the repositories whose reported results are incomplete and whose findings must not be treated as a full assessment.
3. Read the Business Application Names column to establish the business context of each returned row. Without business context the inventory ranks a revenue-critical service and an unused prototype identically. A repository that is not mapped to a business application returns an empty value in this column — treat an empty value as unknown criticality requiring mapping, not as low criticality. To map repositories to applications, see Criteria.
4. Filter Business Application Names to one business-critical application at a time, working in the criticality order recorded in the prerequisites, and address the returned failures before moving to the next application. Filter one application at a time rather than sorting or grouping the column: a repository can belong to several applications, so the Business Application Names column supports neither sorting nor grouping.

Result

You have two sets of repositories — those never scanned, from step 3, and those whose scans did not finish, from step 2. You know which repositories in each set belong to business-critical applications. Every other repository completed a scan.

Note:

• To express coverage as a percentage, read the Total assets count on the AppSec Coverage page with the Asset Type filter set to Repository, subtract the two counts from it, and divide by the total
• For the inventory columns and underlying fields, see Reference B: Inventory columns