Tenant (UI) workflow

The Trust Score is view-only in the Cortex Cloud tenant. It has no API, CLI, IDE, or Terraform workflow.

Navigate to an artifact and view the Trust Score

View the Trust Score from the artifact side card.

1. Navigate to Inventory > All Assets.
2. Under the Compute section, select a category: Container Images, Container instances, VM Instances, or VM Images.
3. Select an artifact from the resulting table whose Trust Score you want to review.
4. In the artifact side card, under the Properties section, locate the artifact Trust Score.

   NOTE: If the artifact has a complete Code-to-Cloud lineage, the Properties section shows the current Trust Score. If the artifact lacks a complete lineage, the Trust Score displays as Not Calculated.

Review the Trust Score evidence

The Trust Score evidence explains why an artifact received its score. It lists every rule and SBOM finding evaluated for the artifact, sorted by Finding Contribution so the findings that lowered the score the most appear first.

1. In the artifact side card, select the Trust Score. You are redirected to the Code to Cloud tab displaying the artifact's Trust Score and Trust Level, and an evidence or findings table.
2. Review the evidence table. Each row is one rule or SBOM finding evaluated for the artifact, with details as displayed in the columns described below. Each finding has a Finding Contribution, that is the amount by which the total Trust Score would potentially rise if you resolved that finding. The table lists findings by Finding Contribution, highest first, so the findings that offer the greatest trust recovery appear at the top.

The evidence table includes the following columns:

Column	Description
Finding Type	The source of the finding: Values: Environment: A CI/CD supply chain check SBOM: A third-party package risk
Category	The Supply Chain Security category of the finding (such as Vulnerability). For category details, refer to Reference B: Supply Chain Security Category values
Finding Name	The name of the finding
Finding (Rule)-Id	The identifier of the finding or the rule that generated the finding
Finding Severity	The severity of the finding, defined by its detection rule: Critical, High, Medium, Low, or Info
Affected Asset	The asset the finding applies to. For an SBOM finding, the third-party package; for an Environment finding, the supply chain asset (for example, the VCS repository, CI/CD pipeline, or instance) evaluated in the artifact's Code-to-Cloud path
Updated at	The date and time the finding was last updated. For example, when its status changed or it was re-evaluated during a Trust Score recalculation
Finding Contribution	The percentage by which the finding potentially lowers the artifact Trust Score if mitigated

Prioritize remediation by Trust Score Contribution

Use the Trust Score Contribution to determine which supply chain findings to address first. Because this metric measures exactly how much an open finding lowers an artifact's Trust Score, you should prioritize remediating high-contribution findings—such as critical vulnerabilities or high-severity failed CI/CD checks—to achieve the largest immediate trust recovery. Once those primary issues are resolved, you can schedule lower-contribution findings for routine remediation, addressing them later or in batches based on their Supply Chain Security Category.

Remediate a finding

1. In the Trust Score evidence table: Select the column options control > enable the Finding ID column. The Finding ID column displays a unique identifier for each finding row.
2. Identify the highest-contribution finding at the top of the table. Copy its Finding ID value.
3. Navigate to Cases & Issues > Issues.
4. Select the Findings tab.
5. Filter the Findings table by ID equal to the Finding ID you copied from the Trust Score evidence table.
6. Select the matching finding row. The finding side card opens, showing the finding details.
7. Review the finding's general remediation guidance and its contributing risk factors, then apply the recommended fix.

Results

After you resolve the finding, Cortex Cloud raises the artifact's Trust Score by that finding's contribution on the next Trust Score recalculation. Repeat this procedure for the next highest-contribution finding to recover the most trust first.

NOTE: The Trust Score recalculates periodically. The recovered Trust Score appears after the next recalculation, not immediately after you resolve the finding.