> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/package-operational-risk-scanner.md).

# Package operational risks

The package operational risk scanner safeguards your software supply chain by identifying open-source packages with elevated operational risk, packages that are deprecated, unmaintained, unpopular, or exhibit indicators of reduced community support. By shifting security left, this closes the gap between code-time dependency consumption and production-time security posture, preventing abandoned, unsupported, or degraded packages from silently propagating into live environments.

The operational risk scanner calculates a composite risk score for each open-source package based on two primary dimensions: maintenance and popularity. The composite score determines the operational risk severity (High, Medium, Low) assigned to the package.

#### What package operational risk issues deliver

Package operational risk issues close the gap between the open-source dependencies declared in your codebase and the operational health of your software supply chain. Without pre-deployment operational risk assessment, packages with low maintenance activity, limited community engagement, deprecated status, or outdated support propagate silently into production environments, creating supply chain fragility that is expensive to remediate after deployment, including emergency package migrations, compatibility regressions, and unpatched security exposure from abandoned upstream projects.

Package operational risk complements CVE assessment within Application Security; learn [how it fits in the ecosystem](/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/package-operational-risk-scanner/how-package-operational-risk-issues-fit-in-the-application-security-ecosystem.md).

## Prerequisites

| Prerequisite        | Description                                                                                                 |
| ------------------- | ----------------------------------------------------------------------------------------------------------- |
| License             | An active Cortex Cloud license with Application Security add-on entitlements                                |
| RBAC Role           | The AppSec Admin or SOC Analyst role, or an equivalent custom role with issue management permissions        |
| VCS Integration     | At least one Version Control System (GitHub, GitLab, Bitbucket, Azure DevOps) integrated and active         |
| SCA Scanner         | The SCA scanner enabled for the target repositories (operational risk scanning is included in SCA scanning) |
| Periodic or PR Scan | At least one completed periodic scan or PR scan that includes SCA scanning results                          |

## Workflows

* [Understand the package operational risk table](/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/package-operational-risk-scanner/understand-the-package-operational-risk-table.md)
* [Investigate, prioritize and remediate package operational risk issues](/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/package-operational-risk-scanner/investigate-and-remediate-package-operational-risk-issues.md)
* [Understand package operational risk findings](/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/package-operational-risk-scanner/understand-package-operational-risk-findings.md)

## Core achievements and use cases

* **Shifting security left and developer integration:** Detecting operationally risky dependencies at code-time, before applications are deployed, reduces the cost and risk of post-deployment remediation. Operational risk scans identify and flag critical issues such as deprecation and low maintenance directly within your dependency manifest files. This scanning integrates seamlessly into development workflows, providing real-time security feedback
* **Accelerating issue remediation:** Manual fix guidance enables developers to resolve operational risk issues directly in the source repository without context-switching to external tools. All Critical and High operational risk findings are categorized as actionable issues. The platform streamlines remediation efforts by offering guidance and data to help you migrate to healthier alternative packages
* **Reducing operational risk noise:** Severity-based prioritization isolates the packages with critical maintenance, popularity, or deprecation issues from healthy, actively maintained dependencies, ensuring teams focus on the most impactful supply chain risks
* **Establishing compliance baselines and policy enforcement:** Mapping operational risk findings to package health metrics provides auditable evidence of compliance with SLSA, OWASP SCVS, and organizational security policies. Furthermore, you can create and apply custom policies and rules that define how the system responds to operational risk threats, allowing for tailored security checks and automated actions, such as blocking CI runs or pull requests based on detected operationally risky packages


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/package-operational-risk-scanner.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.