Security Insights
/security/insights). Admins see extra connectors, repository setup, and org-wide scan defaults. Security Insights is the operations view for IaC security: live and on-demand scans, misconfiguration findings, severity trends, and remediation guidance. The Governance Dashboard is the policy posture view — violations, exceptions, compliance, and settings. Use both; they are not duplicates.
Page layout
Above the main tabs, the page shows quick actions, related links, scan readiness, hero KPIs, and a three-step How Security Insights works guide. KPI cards are clickable and jump to scan history, findings, or repository scanning.
| Area | What it shows |
|---|---|
| Hero KPIs | IaC scans run, open findings, critical/high count, repos with live scan enabled. |
| Quick actions | Scan Git repository (or set up repo scanning), scan stack or workspace; admins also connect repositories and open scan defaults. |
| Related / Where findings go next | My findings; Policy packs (when you have policy:manage); admins also see Governance dashboard, Policy library, Live scan settings, and Policy evaluation. |
| Scan readiness | Connected repo count, enabled policy count, and whether built-in scanners or policy packs are active. |
Non-admins see an info banner: repository connections, live-scan defaults, and policy pack installation are administrator-managed. You can still scan Git repos and platform resources you can access — built-in misconfiguration and secrets checks always run.
Overview tab
The Overview tab summarizes IaC security posture from repository and platform scans: security score/grade, severity breakdown, findings trend, findings by category and cloud, remediation progress, attack-surface summary, security activity timeline, and recommendations.
Typical actions:
Read the score
Review the grade and severity mix before a leadership or sprint review.
Follow recommendations
Enable live scan on repos, install a policy pack, or close critical findings.
Jump to related areas
Use connector links to open Governance Dashboard, Policy Library, Policy Packs, or My findings.
Stay updated
Review timeline events and track remediation progress over time.
When you click Open findings or Critical/high on the hero KPIs, admins are routed to Governance Dashboard → Violations; other users go to My findings.
IaC scans tab
The IaC scans tab is dedicated to infrastructure-as-code scanning — not CVE browsing or SBOM generation. It covers two scan sources:
- Git repository — scan synced GitHub/GitLab code (one-time or continuous via live scan).
- Platform resource — scan IaC from a project, stack, IaC workspace, or environment you can access, or paste content directly.
| Surface | What you can do |
|---|---|
| Live IaC scan (repositories) | Enable or disable live scan per connected repo; run Scan now on synced code. |
| Live IaC CIS dashboard | Review CIS-oriented posture from live repository scans. |
| Live IaC scan history | Inspect past live-scan runs and outcomes per repository. |
| Platform on-demand scans | Run and review scans against platform resources; open a row for finding detail. |
- Enable live scan on connected repos so new IaC is evaluated without a manual click every time.
- The org default for new repos is set under Governance Dashboard → Settings (live-scan defaults).
- Admins connect repos under Administration → Integrations → Source Control.
On-demand scan engines include:
- Terraform, OpenTofu, Pulumi, CloudFormation
- Secrets in IaC (hardcoded credentials, API keys, tokens)
Policy packs are optional for scanning — built-in misconfiguration and secrets checks always run. When policies are assigned, scan and evaluation results also appear as policy violations on the Governance Dashboard.
Organization-wide platform scans are reserved for the org owner. Other users scan projects, stacks, workspaces, and environments within their access scope.
Quick actions
From the quick-actions bar at the top of Security Insights:
Scan Git repository
Opens the IaC scans tab focused on connected repositories (or setup when none are linked).
Scan stack or workspace
Opens the on-demand scan dialog for a platform resource you can access.
Connect repository
Admins: link GitHub/GitLab under Administration → Source Control.
Scan defaults
Admins: open Governance → Settings for live-scan defaults on new repositories.
My findings
My findings is a separate page at /security/findings (Security & Governance → My findings). It is the engineer work queue: open misconfigurations and policy failures on repositories and stacks you can access. Visibility follows resource access, not the full organization (unless you are org Admin/Owner).
What you can do
- Filter and inspect violations on your stacks and repos.
- Open a finding, fix the IaC, and re-scan from Security Insights.
- Use Scan Git repository on My findings to jump to
/security/insights?tab=scans&focus=repos.
What you cannot do here
- Install org-wide policy packs or change compliance frameworks.
- Change gate mode or live-scan defaults.
- Approve exceptions for the whole organization.
Non-admins see a banner that organization-wide policy packs, scan defaults, and compliance settings are managed by an administrator. Admins are pointed to the Governance Dashboard for org-wide remediation.
How scans relate to deploy gates
- A scan or policy evaluation produces findings / violations.
- If the policy is enforcing and the org (or environment) gate is Enforce, PLAN/APPLY can block.
- Advisory mode records violations without blocking deployment.
- Fail-open blocks on enforcing violations but allows deploy when the evaluation engine errors (with warnings).
Fix the code, re-scan, then retry the deployment. Do not disable the gate globally to unblock one stack unless that is an explicit leadership decision. Per-environment gate overrides are configured under Governance → Settings.
Permissions
| Permission / role | Typical access on Security Insights |
|---|---|
security:read | View Security Insights dashboards, scan history, and findings in scope. |
governance:manage or org Admin/Owner | Connect repos, scan defaults, full connector set, org-wide remediation via Governance Dashboard. |
policy:manage | Policy packs connector; act on findings within scope. |
security:manage | Resolve or suppress findings and update remediations. |
| Viewers | Read-only access to dashboards and findings. |