Coverage
Connector capability and reachability
Fixture-only capability and reachability examples. No customer connector is attached; a quiet or offline collector is a gap, not proof of a clean source.
On-prem file shares, Managed endpoint agent, Vendor model provider, Enclave collector (air-gapped), Analytics warehouse are not reporting normally. Everything behind them is a coverage gap. Percentages are omitted wherever the denominator itself is unknown.
Risk coverage map
Representative register examples across six families, not a score or a claim that all R01–R60 controls are covered.
Discovery, classification, purpose and source2 examples
Shadow review is illustrated; ephemeral and log capture are planned.
Related screen →Purpose-specific enforcement is not implemented.
Related screen →Preparation, training, model and supply chain1 example
Model records are samples; training privacy tests and artifact controls are planned.
Related screen →Retrieval, runtime, agents and data movement4 examples
Sample access paths exist; revocation propagation is not demonstrated.
Related screen →No live inspection or streaming gate is connected.
Related screen →Trace examples do not prove fallback or provider-file inspection.
Related screen →Tool permissions are previewed, not enforced across delegated agents.
Related screen →Evaluation, release, drift and third parties1 example
The fixture shows stale, skipped and unreachable collection; detection is not live.
Related screen →Incident, retirement, disposal and recovery1 example
Retirement examples are shown; backup and residual verification are planned.
Related screen →Security platform itself1 example
Stale enclave evidence is shown; offline bundle tamper tests are not implemented.
Related screen →“Sample evidence” means a synthetic fixture is visible, not that a control has passed. Proposed and unavailable cases remain planned.
Scan denominator and collection lag
Skipped items are counted as skipped, never folded into the scanned total.
Capability matrix
Declared capability per connector, with the limits that apply to each one.
Support platform (managed)
con-zendesk
- Content readFull text and metadata.Pass
- Effective access readGroup expansion supported.Pass
- Source mutationAttachment delete supported; ticket redaction is not.Partial
- Change eventsEvent driven.Pass
Unsupported formats: .heic, password-protected .zip
Skipped items are reported as skipped, never as scanned clean.
On-prem file shares
con-onprem-files
- Content readTwo archive shares refuse the collector credential.Partial
- Effective access readNTFS ACL expansion.Pass
- Source mutationWrite capability never tested in this environment.Unknown
- Change eventsNo event feed; scheduled scan only.Fail
Unsupported formats: scanned .tif without OCR, legacy .wpd
19% of the known denominator is unreachable. Unreachable is a coverage gap, not a pass.
Git hosting
con-git
- Content readRate limited to 12 repos per cycle.Pass
- Effective access readOrg and team expansion.Pass
- Source mutationRead-only integration by design.Not applicable
- Change eventsWebhook based.Pass
Unsupported formats: git-lfs binaries
29 repositories are queued, not clean. Progress is shown against the full denominator.
Managed endpoint agent
con-endpoint
- Installed tooling inventoryManaged devices only.Pass
- Configured MCP bindingsConfig file inspection where permitted.Pass
- Observed runtime callsOnly inspected on devices with the network module enabled.Partial
- Source mutationAdvisory only.Not applicable
No unsupported formats declared for this surface.
372 devices are unmanaged or opted out. Their AI use is unknown, not absent.
Vendor model provider
con-vendor-llm
- Usage log read24-hour retention on the provider side.Pass
- Prompt content readNot exposed by the provider. Inspection happens at our boundary instead.Not applicable
- Provider internalsOpaque. A successful SSO connection does not verify internals.Unknown
- Source mutationNo API to delete retained prompts.Fail
No unsupported formats declared for this surface.
Successful authentication is not coverage of what the vendor does internally.
Mesh boundary collector (EU)
con-collector-eu
- Input inspectionBlocking decision before forwarding.Pass
- Output inspectionRedaction supported.Pass
- Tool-call inspectionBuild-step stdout is not inspected.Partial
- Change eventsStreaming.Pass
No unsupported formats declared for this surface.
Blind interval on 2026-09-22 16:29–19:40 UTC is recorded on finding fnd-2304.
Enclave collector (air-gapped)
con-enclave
- Local content readInside the enclave only.Pass
- Local policy enforcementRuns without network access.Pass
- Evidence exportManual transfer; 72-hour cadence.Partial
- Signature updatesDetector bundle is 12 days old.Stale
No unsupported formats declared for this surface.
Snapshot age is displayed. An offline connector is never shown as healthy merely because no alerts arrived.
Analytics warehouse
con-warehouse
- Content readCollector deregistered; capability untested since.Unknown
- Effective access readUntested.Unknown
- Source mutationUntested.Unknown
- Change eventsNo signal for 16 days.Fail
No unsupported formats declared for this surface.
The denominator itself is unknown here, so no percentage can be claimed.