> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/artifact-trust-score.md). # Artifact Trust Score The Artifact Trust Score provides a single, quantifiable measure to evaluate the integrity of software artifacts derived from the security posture of the supply chain that created the artifact. Cortex Cloud computes a Trust Score calculated by percentage (%) by aggregating multiple supply chain signals, including third-party software (SBOM) risks, vulnerabilities, malicious packages, and the security posture of the CI/CD environment. This score is then categorized into standardized Trust Level bands. This allows you to evaluate trustworthiness at a glance and apply consistent deployment and remediation standards across your environment. ## Supported artifacts Artifacts eligible for trust scoring include **VM images**, **VM instances**, **container images**, and **container instances**. ## Core capabilities 1. **Assess artifact integrity** by using a Trust Score to determine whether it is safe to promote to runtime, instead of manually correlating vulnerabilities, license risks, operational risks, malicious packages, and failed CI/CD checks across separate tables 2. **Compare and govern artifacts consistently** by grouping them into four Trust Level bands, ensuring artifacts with similar trustworthiness are handled uniformly 3. **Prioritize remediation** by ranking open findings based on their impact on the Trust Score, focusing efforts on the issues that most significantly reduce artifact trust 4. **Route each risk to its owner automatically** by using Supply Chain Security Categories on every rule, finding, and issue to enable precise filtering and faster assignment to the responsible team. 5. **Detect risk in the tools that build your artifacts** by surfacing supply chain tool risks that were previously undetectable, using new out-of-the-box CI/CD detection rules enabled by default ## Core concepts This section defines the foundational concepts used in this guide. * **Trust Score**: A percentage (0–100) that rates an artifact's integrity based on the security posture of its supply chain; a higher score is more trustworthy. The score is a weighted average of the artifact's supply chain parameters, balancing the SBOM risk value and the CI/CD (Dev Environment) risk value in equal parts * **Trust Score overrides**: Regardless of the weighted calculation, certain conditions in any single SBOM package override the entire artifact Trust Score. Cortex Cloud applies the overrides in the following order: 1. If the count of malicious packages (malware) is greater than 0, the artifact Trust Score is 0. 2. Otherwise, if the count of Critical license risks is greater than 0, the artifact Trust Score is 0. 3. Otherwise, if the artifact has no complete Code-to-Cloud lineage, the artifact Trust Score is Not Calculated. WARNING: A confirmed malicious package sets the artifact Trust Score to 0 immediately. Do not promote an artifact with a Trust Score of 0 caused by malware to production. * **Trust Level**: The band that classifies an artifact by its Trust Score (Very High, High, Medium, or Low Trust). For more information, refer to [Reference A: Trust Level bands](/application-security/software-supply-chain-security/visibililty-and-inventory/artifact-trust-score/references/reference-a-trust-level-bands.md) * **Finding Contribution**: The number of points a single open finding subtracts from an artifact's Trust Score when mitigated; use it to rank which issues to remediate first. * **Not Calculated state**: The state Cortex Cloud shows when an artifact has no complete Code-to-Cloud lineage or predates registry or cloud onboarding, so no Trust Score can be computed * **Recalculation behavior**: Cortex Cloud recalculates the Trust Score periodically, and the score can only decrease as new vulnerabilities or malware are discovered in the artifact's packages * **Supply Chain Security Category**: The **Rule Category** automatically assigned to each supply chain rule, finding, and issue for ownership routing. Refer to [Reference B: Supply Chain Security Category values](/application-security/software-supply-chain-security/visibililty-and-inventory/artifact-trust-score/references/reference-b-supply-chain-security-category-values.md) * **Supply Chain Tools detection rules**: New out-of-the-box (OOTB) CI/CD rules, enabled by default, that detect risks in the tools that build your artifacts and generate Supply Chain findings ### Prerequisites | Prerequisite | Description | | ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Cortex Cloud license** | An active Cortex Cloud license with an Application Security (AppSec) add-on license | | **RBAC role** | A role with permissions to view supported artifacts, and supply chain findings and issues | | **SBAC scope** | Access to the target application scope. Trust Score values display only for artifacts within the user's assigned application boundary | | **Code-to-Cloud lineage** | The Trust Score requires complete Code-to-Cloud lineage from code to runtime. Without it, the artifact’s Trust Score appears as **Not Calculated** in the artifact side card rather than as a 0–100 value | | **Supply chain data sources** | Onboarded VCS and CI/CD data sources so the supply chain (CI/CD) assets in the artifact's build path can be evaluated, and onboarded registries so artifacts are discovered | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/artifact-trust-score.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.