Beacon
Beacon is VSEC’s repository-wide risk overseer. It watches across all active risks simultaneously — scanning for gaps in completeness, currency, and coverage — and surfaces its findings in VSEC Monitor. Each finding links directly to the affected risk, asset, or external signal so you can act on it in one click.
Beacon’s altitude is across the risk repository, not inside any one risk. Per-risk AI analysis (understanding, proposed fields, and one-click suggested actions) lives on the Context tab.
Beacon Card
Beacon appears as a summary card at the top of the Risk Manager page — one line showing how many risks Beacon is watching, a severity breakdown (high / medium / low) when anything needs attention, and a View in Monitor link.
Beacon depends on VSEC Monitor for its underlying scan.
The full findings list — grouped by rule, with severity filters and deep links to each affected risk, asset, or signal — lives on Monitor → Findings, not on the Risk Manager page itself. Which rules Beacon runs, and their thresholds, are configured on Monitor → Rules.
Finding Types
Beacon surfaces seven types of cross-cutting findings, each backed by a rule on Monitor → Rules — disable any rule there to silence its findings, and tune thresholds on the ones that have them:
| Type | Trigger | What to do |
|---|---|---|
| Incomplete risk | A risk someone is actively building (it has evidence or a score row) that still cannot be scored because it is missing a required input (likelihood or impact); untouched risks are not flagged | Add evidence to the risk so both dials are populated — see Model Health |
| Stale score | New evidence arrived after the last scoring run — the displayed score no longer reflects all inputs | Open the risk and re-score, or trigger a re-curation via the Context tab |
| Stalled event | A Clause-8 evidence item has been in the Event state for the configured threshold or longer (default 30 days; configurable, minimum 1 day) | Advance the evidence to Weakness or Vulnerability, or mark it Not Applicable with a rationale |
| Untreated high | A risk with a residual score at or above a configurable threshold (default 4) and no treatment decision set | Open the risk and assign a treatment (Avoid / Reduce / Share / Retain) |
| Uncovered asset | An asset with no risks, adjacent in the asset hierarchy to assets that do carry risks | Review whether the asset needs its own risk entries |
| BOM country of origin | A package in an asset’s SBOM or HBOM, or a crypto material in its CBOM (uploaded directly, or for software, synced from linked xZETA firmware) originates from a country flagged in the rule’s configuration | Review the flagged asset’s bill of materials for supply-chain or national-origin risk |
| External signal | A signal in the External signals inbox matched one of your assets — by asset name or the asset’s Keywords / Business Unit property values. The rule’s watch keywords additionally flag notable signals that don’t map to a specific asset | Open the signal in Monitor and triage it — attach it as evidence to an existing risk or raise a new Monitor risk |
Unlike the other rules, External signals is off by default — its toggle doubles as the external-feed switch, so enabling the rule is what turns on feed ingestion into the signals inbox.
BOM Country of Origin
Unlike Beacon’s other findings, which are read-only projections over data that already exists elsewhere, this rule also creates the underlying risk. The first time it detects a package from a flagged country on an asset’s BOM, VSEC automatically opens a Monitor-type risk on that asset (with the flagged package details recorded as evidence); the Beacon finding then links straight to it. Detection re-runs whenever an asset’s BOM changes or the flagged-country list is updated.
The list of flagged countries (ISO 3166-1 alpha-2 codes, e.g. CN, RU) is configured on the rule itself, on Monitor → Rules — it is no longer a setting on the xZETA integration. This rule scans every BOM source for an asset together: files uploaded directly to its SBOM/HBOM property, SBOMs synced automatically from linked xZETA firmware, and CBOM crypto materials (keys, certificates) synced from that same firmware — see Cryptographic Materials (CBOM).
How Beacon Works
Beacon derives its findings from persisted risk-score rows and the asset-link graph — it does not query each risk individually on demand. Scans are fast and bounded regardless of how many risks are in the workspace.
Beacon findings are a read-only projection — they are computed on demand and never stored as a separate table. Adding evidence, updating a treatment, or advancing a weakness state updates the underlying data; the next scan reflects the change automatically. The BOM country-of-origin rule is the one exception: its risk-creating sweep runs separately, as described above.
Permissions
Viewing the Beacon card and the Monitor findings list requires read access to Risk Manager (the same permission needed to view the risks list). Editing rules or triaging signals in Monitor requires update access to Risk Manager.