Asset business context

What it is

Every target carries four operator-set business-context fields. Once they’re set, the executive dashboard and the executive report stop ranking findings by raw CVSS alone. They multiply severity by business criticality so the queue floats what would actually hurt the business if it got popped.

What it produces

Per target:

• Business owner: free-text email or team name. Surfaces in the finding drawer so the analyst knows who to route work to.
• Criticality: five-bucket enum: prod / staging / dev / internal / test, with unspecified as the default. Mirrors the convention every NIST / ISO27001 control catalog assumes.
• Data classification: five-bucket enum: public / internal / confidential / restricted / pii. Drives the “if compromised, what gets exfiltrated” reasoning.
• Vendor: free-text. Useful when the asset is a third-party SaaS or a managed appliance (Salesforce, Workday, an appliance model number).

What to use it for

• Rank the work that matters by business, not just CVSS.
• Route findings to the right team automatically (the owner is visible on every finding drawer).
• Tell an auditor what’s regulated vs. internal at a glance.
• Give the executive report a real top-risks section: “high on prod payment-gateway” reads correctly above “critical on dev-lab redis”.

Why it matters

Without business context, every finding ranks by raw CVSS, which sorts a critical CVE on a dev redis lab above a high CVE on the prod payment gateway. Every CISO checklist starts here: tell me the business impact, not just the technical severity. This is the gap from the enterprise-pivot doc §9 #2/#3.

Why it’s valuable

• Risk score is debuggable. A tiered weighted sum (severity + criticality + exploitability bonus), not a black- box ML model. The ordering is stable + the operator can predict it.
• Empty defaults work. Existing targets stay rankable by raw CVSS until context is filled in; you don’t have to do a Big Bang back-fill.
• Same scoring everywhere. The executive dashboard’s top-10 queue + the executive report’s top-open-risks list use the identical risk formula, so the artifact handed to the board matches the screen the analyst is looking at.

How to use it

1. Open Targets in the left nav, pick a target row.
2. Click Edit → the Business context section sits below the scan settings.
3. Set criticality + data classification (selects); fill business owner + vendor if you have them. Save.
4. Open the executive dashboard. Top-10 priority rows now wear a prod or staging badge when criticality is set, and the ranking reflects it.

Risk-score weights

Dimension	Weights
Severity	critical = 8 · high = 6 · medium = 3 · low = 1
Criticality	prod = +4 · staging = +2 · internal = +1 · unspecified = 0 · dev = −1 · test = −2
Exploitability	AI verdict = compromised → +3

A “high on prod” (6 + 4 = 10) outranks a “critical on dev” (8 − 1 = 7). That’s the headline.