Beacon
Beacon is VSEC’s repository-wide risk overseer. It watches across all active risks simultaneously, scanning for gaps in completeness, currency, and coverage, and surfaces its findings in VSEC Monitor. Each finding links directly to the affected risk, asset, or external signal so you can act on it in one click.
Beacon’s altitude is across the risk repository, not inside any one risk. Per-risk AI analysis (understanding, proposed fields, and one-click suggested actions) lives on the Context tab.
Beacon Card
When VSEC Monitor is enabled, a Beacon button appears at the top of the Risk Manager page, with a badge counting the findings that need attention. Click it to expand the summary card: a severity breakdown (high / medium / low) when anything needs attention, or an all-clear message, and a View in Monitor link.
Beacon depends on VSEC Monitor for its underlying scan, so the button is not shown when Monitor is not enabled.
The full findings list, grouped by rule with severity filters and deep links to each affected risk, asset, or signal, lives on Monitor → Findings, not on the Risk Manager page itself. Which rules Beacon runs, and their thresholds, are configured on Monitor → Rules.
Finding Types
Beacon surfaces eight types of cross-cutting findings, each backed by a rule on Monitor → Rules. Disable any rule there to silence its findings, and tune thresholds on the ones that have them:
| Type | Trigger | What to do |
|---|---|---|
| Incomplete risk | A risk someone is actively building (it has evidence or a score row) that still cannot be scored because it is missing a required input (likelihood or impact); untouched risks are not flagged | Add evidence to the risk so both dials are populated — see Model Health |
| Stale score | New evidence arrived after the last scoring run, so the displayed score no longer reflects all inputs | Open the risk and review the new evidence. There is no manual re-score; the score is recalculated when evidence on the risk is added, edited, or removed |
| Stalled event | A Clause-8 evidence item has been in the Event state for the configured threshold or longer (default 30 days; configurable, minimum 1 day) | Advance the evidence to Weakness or Vulnerability, or mark it Not Applicable with a rationale |
| Untreated high | A risk with a residual score at or above a configurable threshold (default 4) and no treatment decision set | Open the risk and assign a treatment (Avoid / Reduce / Share / Retain) |
| Uncovered asset | An asset that is not the primary asset of any risk, but is a parent or child of an asset that is. Only each risk’s primary asset counts | Review whether the asset needs its own risk entries |
| Threat library coverage | An interface your assets expose that no threat library entry covers, or a library entry that matches assets but has not been applied to any of their risks | Add the suggested starter entry from the asset’s Context tab, or review the library entry and its keywords |
| BOM country of origin | A package in an asset’s SBOM or HBOM, or a crypto material in its CBOM (uploaded directly, or for software, synced from linked xZETA firmware) originates from a country flagged in the rule’s configuration | Review the flagged asset’s bill of materials for supply-chain or national-origin risk |
| External signal | A signal in the External signals inbox matched one of your assets, by asset name or the asset’s Keywords / Business Unit property values. The rule’s watch keywords additionally flag notable signals that don’t map to a specific asset | Open the signal in Monitor and triage it: attach it as evidence to an existing risk or raise a new Monitor risk |
External signals and Threat library coverage are off by default. The External signals toggle doubles as the external-feed switch, so enabling the rule is what turns on feed ingestion into the signals inbox. Threat library coverage is only as useful as your library’s keywords, so it stays off until you turn it on.
BOM Country of Origin
Unlike Beacon’s other findings, which are read-only projections over data that already exists elsewhere, this rule also creates the underlying risk. The first time it detects a package from a flagged country on an asset’s BOM, VSEC automatically opens a Monitor-type risk on that asset (with the flagged package details recorded as evidence); the Beacon finding then links straight to it. Detection re-runs whenever an asset’s BOM changes or the flagged-country list is updated.
The list of flagged countries (ISO 3166-1 alpha-2 codes, e.g. CN, RU) is configured on the rule itself, on Monitor → Rules; it is no longer a setting on the xZETA integration. This rule scans every BOM source for an asset together: files uploaded directly to its SBOM/HBOM property, SBOMs synced automatically from linked xZETA firmware, and CBOM crypto materials (keys, certificates) synced from that same firmware. See Cryptographic Materials (CBOM).
How Beacon Works
Beacon derives its findings from persisted risk-score rows and the asset-link graph — it does not query each risk individually on demand. Scans are fast and bounded regardless of how many risks are in the workspace.
Beacon findings are a read-only projection — they are computed on demand and never stored as a separate table. Adding evidence, updating a treatment, or advancing a weakness state updates the underlying data; the next scan reflects the change automatically. The BOM country-of-origin rule is the one exception: its risk-creating sweep runs separately, as described above.
Permissions
Viewing the Beacon card and the Monitor findings list requires read access to Risk Manager (the same permission needed to view the risks list). Editing rules or triaging signals in Monitor requires update access to Risk Manager.