> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/branch-periodic-scan-workflow/assess-scan-coverage-and-health-across-the-portfolio.md).

# Assess scan coverage and health across the portfolio

Establish which repositories have never been scanned, and which have scans that did not finish, before drawing any conclusion from the findings the scans produced. This assessment spans two pages: the **AppSec Coverage** page establishes the repositories that have never been scanned, and the **Branch Periodic Scans** inventory establishes the repositories whose scans did not finish.

#### Prerequisites

* The `Application Security Periodic View` permission for the Branch Periodic Scans inventory, and access to the [AppSec Coverage](/application-security/application-security-posture-management-aspm/coverage.md) page
* Establish business application criticality: ordering before you begin. Identify and list your business applications in order of criticality, flagging the ones essential to your operations. Navigate to **Application Security** > **Application Management** > **Business Applications**, sort the table by the **Business Criticality** column, and record the application names in that order. Which criticality levels count as business-critical is a governance decision — confirm it with the AppSec Manager

#### Establish the repositories that never that have never been scanned

1. Navigate to **Application Security** > **AppSec Coverage**.
2. Scope the asset coverage table to VCS repositories: Apply the **Asset Type** filter and select **Repository** (The Coverage page reports repositories, CI/CD pipelines, and container image repositories together, and without this filter the returned population cannot be compared to the repository rows in the scan inventory).
3. Filter the scoped table by **Last Scan Status** and select **Not Scanned Yet**. These repositories have scanners switched on but have never been scanned, so they appear in no scan inventory row and contribute no findings. Record the count.\
   **Note**: Do not use the **Not Covered** value on the **Coverage by Status** widget for this count. **Not Covered** means no scanner is switched on. **Not Scanned Yet** means scanners are switched on but nothing has run. A repository can be fully covered and never scanned at the same time, so the widget misses repositories you need.
4. Triage the returned repositories before proceeding. Apply the **Business Application Names** filter and select the business-critical applications from your list (see prerequisites). A large number of repositories immediately after a bulk scanner activation is expected and resolves within one scan cycle — see [Configure repository scan coverage](/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/branch-periodic-scan-workflow/configure-repository-scan-coverage.md). A count that persists across more than one cycle indicates a scan execution failure rather than a configuration gap.
5. Verification: Confirm the **Asset Type** filter is set to **Repository** and the **Last Scan Status** filter is set to **Not Scanned Yet** before recording the count as final.

#### Establish the repositories whose scans did not finish

1. Navigate to **Application Security** > **Scans** > **Branch Periodic Scans**, and use the filter bar to filter by repository name, organization, scanned branch, scan health status, and scan date. Bound the assessment to the current cycle with the **Scan Date** filter, so the returned failures are the failures of the period under review rather than every failure the inventory has accumulated — see [Reference B: Inventory columns](/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/references/reference-b-inventory-columns.md#scan-date-filter).
2. Filter **Scan Health** to **Error** and to **Partially** (completed). The returned rows are the repositories whose reported results are incomplete and whose findings must not be treated as a full assessment.
3. Read the **Business Application Names** column to establish the business context of each returned row. Without business context the inventory ranks a revenue-critical service and an unused prototype identically. A repository that is not mapped to a business application returns an empty value in this column — treat an empty value as unknown criticality requiring mapping, not as low criticality. To map repositories to applications, see [Criteria](/application-security/application-security-posture-management-aspm/applications/defining-business-applications.md).
4. Filter **Business Application Names** to one business-critical application at a time, working in the criticality order recorded in the prerequisites, and address the returned failures before moving to the next application. Filter one application at a time rather than sorting or grouping the column: a repository can belong to several applications, so the **Business Application Names** column supports neither sorting nor grouping.

#### Result

You have two sets of repositories — those never scanned, from step 3, and those whose scans did not finish, from step 2. You know which repositories in each set belong to business-critical applications. Every other repository completed a scan.

> **Note:**
>
> * To express coverage as a percentage, read the **Total assets** count on the AppSec Coverage page with the **Asset Type** filter set to **Repository**, subtract the two counts from it, and divide by the total
> * For the inventory columns and underlying fields, see [Reference B: Inventory columns](/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/references/reference-b-inventory-columns.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/branch-periodic-scan-workflow/assess-scan-coverage-and-health-across-the-portfolio.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.