🎉 VSEC Test v4.0.1 is now live! Release Notes ↗
Risk Manager
Risks
Import & Export

Import & Export

Risk Manager supports bulk import of risks from an Excel workbook and PDF report export of the current risks list.

Report (PDF Export)

The Report button on the Risk Manager page builds a PDF of the risks currently shown — using the same filters and Include archived risks setting active on the list. Preview, print, or download the result. If the table has not finished loading, the export is blocked with “Still loading risks. Try again in a moment.” — no partial report can be generated.

An asset scope is required. Set the Filter by assets filter to one or more assets before exporting — an unscoped “all assets” report is disabled (the button is greyed out with an explanatory tooltip) to avoid fanning out to hundreds of asset sections. To include everything intentionally, use the asset picker’s Select all.

The PDF is organized around the evidence model:

  • Risk Origin — Design, Test, or Monitor.
  • Score — shown as Inherent → Residual (the two evidence-driven dials).
  • Controls — lists the Control Library entries applied to the risk that drive the residual score.
  • Evidence — one entry per evidence item: source, summary, CVSS score (where present), Clause-8 weakness state, reference, and date.

The PDF distinguishes archived risks with an Archived banner so they cannot be confused with active risks, and totals the archived count separately from the active priority distribution.

Automated Assessments

Each in-scope asset with a stored SBOM gets an Automated Assessments entry summarizing the automated checks VSEC has run against it — whether the SBOM was uploaded directly or synced from linked xZETA firmware. Today this covers the Country of Origin check:

  • Tallies the SBOM’s package originCountry values against the monitored countries configured on the Beacon BOM country of origin rule.
  • Reports 0 findings (clear) or lists a per-country match count, noting when a matching risk already exists on the asset.
  • Stamps the date the check most recently ran.

Assets without a stored SBOM show no automated assessment entry.

Oversized SBOMs (ZIP Export)

If the combined SBOM across all in-scope assets exceeds the workspace threshold (default 2,500 packages), VSEC replaces the inline SBOM table with a note in the PDF and instead downloads a ZIP file containing:

  • The PDF report
  • sbom.csv — a flat export of every package (Asset, Package, Version, Path, Origin) across the in-scope assets
  • A short README

VSEC shows a toast explaining the ZIP download when this happens. No data is lost — the full SBOM is always included, just as a CSV instead of a rendered table.

Import Risk

Import Risk uploads an Excel workbook (.xlsx) for bulk or automated intake. In the Import Risk dialog, only the Design risk type can be selected — imported risks are created with the Design origin. The workbook must contain sheets with these exact names and columns:

SheetRequired columns
RisksRisk ID, Title, Description, Risk level
Threat Scenarios Attack StepsThreat Scenarios, Title, Associated Attack Step ID, Attack Step Title, Aggregated Attack Feasibility, ET, SE, KoIC, WoO, Eq
Damage ScenariosID, Title, Description, Concerns, Aggregated Impact Level, Threat Scenarios

A workbook missing any of the three sheets is rejected with a formatting error.

Last updated on
Beacon