🎉 VSEC Core 1.0.0 and VSEC Test v4.3.4 are now live! Release Notes ↗
VSEC Core
Risk Manager
Risks
Import & Export

Import & Export

Risk Manager supports bulk import of risks from an Excel workbook and PDF report export of the current risks list.

Report (PDF Export)

The Report button on the Risk Manager page opens a Generate report dialog for the risks currently shown, using the same filters as the list. The dialog shows the scope and three switches:

  • Include archived risks (on by default)
  • Include asset properties (on by default)
  • Include software bill of materials (off by default, because it can greatly increase generation time and report size)

Click Generate report. The report is built in the background and downloads directly when it is ready. If it takes a while, you can close the tab and VSEC notifies you when the report is ready. If the table has not finished loading, the export is blocked with “Still loading risks. Try again in a moment.”, and no partial report can be generated.

No asset filter is needed. With no asset filter applied, the report covers every asset in the workspace. The Report button is disabled only while the workspace has no assets.

The PDF is organized around the evidence model:

  • Risk Origin — Design, Test, or Monitor.
  • Score — shown as Inherent → Residual (the two evidence-driven dials).
  • Controls — lists the Control Library entries applied to the risk that drive the residual score.
  • Evidence — one entry per evidence item: source, summary, CVSS score (where present), Clause-8 weakness state, reference, and date.

The PDF distinguishes archived risks with an Archived banner so they cannot be confused with active risks, and totals the archived count separately from the active priority distribution.

Automated Assessments

Each in-scope asset with a stored SBOM gets an Automated Assessments entry summarizing the automated checks VSEC has run against it — whether the SBOM was uploaded directly or synced from linked xZETA firmware. Today this covers the Country of Origin check:

  • Tallies the SBOM’s package originCountry values against the monitored countries configured on the Beacon BOM country of origin rule.
  • Reports 0 findings (clear) or lists a per-country match count, noting when a matching risk already exists on the asset.
  • Stamps the date the check most recently ran.

Assets without a stored SBOM show no automated assessment entry.

Oversized SBOMs (ZIP Export)

When Include software bill of materials is on and the combined SBOM across all in-scope assets exceeds the workspace threshold (default 2,500 packages), VSEC replaces the inline SBOM table with a note in the PDF and instead downloads a ZIP file containing:

  • The PDF report
  • sbom.csv — a flat export of every package (Asset, Package, Version, Path, Origin) across the in-scope assets
  • A short README

VSEC shows a toast explaining the ZIP download when this happens. No data is lost — the full SBOM is always included, just as a CSV instead of a rendered table.

Import Risk

The Import from file tab of the New Risk dialog uploads an Excel workbook (.xlsx) for bulk or automated intake. Only the Design risk type can be selected, and imported risks are created with the Design origin. The workbook must contain sheets with these exact names and columns:

SheetRequired columns
RisksRisk ID, Title, Description, Risk level
Threat Scenarios Attack StepsThreat Scenarios, Title, Associated Attack Step ID, Attack Step Title, Aggregated Attack Feasibility, ET, SE, KoIC, WoO, Eq
Damage ScenariosID, Title, Description, Concerns, Aggregated Impact Level, Threat Scenarios

A workbook missing any of the three sheets is rejected with a formatting error. A workbook that would take the workspace past its plan’s risk limit is also rejected.

Last updated on
Beacon