AI Bridge / Watcher Artifact
CVSS Environmental Dashboard
Interactive cloud-ready view of the PCI segmented lab run. The dashboard connects local environmental evidence, CVSS Environmental labels, before-after score deltas, and audit-trace material used by the manuscript.
Latest run
pci_segmented_lab_20260517_143146
Case
pci_segmented_lab
6
Findings
12
Assessments
2
Downgraded
4
Unchanged
-0.267
Mean delta
Before/after environmental effects
| Finding | Asset | CVE | Type | Before | After | Delta | MAV | Effect |
|---|---|---|---|---|---|---|---|---|
| F-001 | A-CORP-SRV | CVE-2016-0036 | SYS | 8.8 | 8.0 | -0.8 | N to A | downgraded |
| F-002 | POS-01 | CVE-2016-0469 | SYS | 7.8 | 7.8 | 0.0 | L to L | unchanged |
| F-003 | ADMIN-01 | CVE-2016-3234 | APP | 8.8 | 8.0 | -0.8 | N to A | downgraded |
| F-004 | WIRELESS-LEGACY-01 | CVE-2016-1619 | APP | 7.8 | 7.8 | 0.0 | N to N | unchanged |
| F-005 | CORE-SW-01 | CVE-2016-6441 | SYS | 9.7 | 9.7 | 0.0 | A to A | unchanged |
| F-006 | CORE-SW-01 | CVE-2016-6428 | SYS | 8.8 | 8.8 | 0.0 | A to A | unchanged |
Assessment rows
| Finding | State | Asset | Base | Env | CR | IR | AR | MAV | Expected |
|---|---|---|---|---|---|---|---|---|---|
| F-001 | before | A-CORP-SRV | 8.8 | 8.8 | M | M | H | N | |
| F-001 | after | A-CORP-SRV | 8.8 | 8.0 | M | M | H | A | |
| F-002 | before | POS-01 | 7.8 | 7.8 | H | H | H | L | |
| F-002 | after | POS-01 | 7.8 | 7.8 | H | H | H | L | |
| F-003 | before | ADMIN-01 | 8.8 | 8.8 | M | M | M | N | |
| F-003 | after | ADMIN-01 | 8.8 | 8.0 | M | M | M | A | |
| F-004 | before | WIRELESS-LEGACY-01 | 8.8 | 7.8 | L | L | M | N | |
| F-004 | after | WIRELESS-LEGACY-01 | 8.8 | 7.8 | L | L | M | N | |
| F-005 | before | CORE-SW-01 | 9.6 | 9.7 | M | H | H | A | |
| F-005 | after | CORE-SW-01 | 9.6 | 9.7 | M | H | H | A | |
| F-006 | before | CORE-SW-01 | 8.3 | 8.8 | M | H | H | A | |
| F-006 | after | CORE-SW-01 | 8.3 | 8.8 | M | H | H | A |
Run manifest
Input hashes make the run reproducible and auditable.
8
case files hashed
Audit trace sample
[
{
"cve": "CVE-2016-0036",
"state": "before",
"metric": "CR/IR/AR",
"reason": "asset=A-CORP-SRV scope_before=in_scope role=corporate_service",
"source": "business_impact.yaml + pci_scope.yaml + assets.csv",
"asset_id": "A-CORP-SRV",
"finding_id": "F-001"
},
{
"cve": "CVE-2016-0036",
"state": "before",
"metric": "ModifiedBaseDefaults",
"reason": "Unchanged modified metrics inherit base values unless local evidence overrides them.",
"source": "vulnerabilities.csv",
"asset_id": "A-CORP-SRV",
"finding_id": "F-001"
},
{
"cve": "CVE-2016-0036",
"state": "after",
"metric": "CR/IR/AR",
"reason": "asset=A-CORP-SRV scope_after=out_of_scope role=corporate_service",
"source": "business_impact.yaml + pci_scope.yaml + assets.csv",
"asset_id": "A-CORP-SRV",
"finding_id": "F-001"
},
{
"cve": "CVE-2016-0036",
"state": "after",
"metric": "MAV",
"reason": "base AV=N but external_exposure_after=internal_only; network attack constrained to adjacent/internal segment.",
"source": "assets.csv + firewall_rules.yaml",
"asset_id": "A-CORP-SRV",
"finding_id": "F-001"
},
{
"cve": "CVE-2016-0036",
"state": "after",
"metric": "ModifiedBaseDefaults",
"reason": "Unchanged modified metrics inherit base values unless local evidence overrides them.",
"source": "vulnerabilities.csv",
"asset_id": "A-CORP-SRV",
"finding_id": "F-001"
},
{
"cve": "CVE-2016-0469",
"state": "before",
"metric": "CR/IR/AR",
"reason": "asset=POS-01 scope_before=in_scope role=payment_processing",
"source": "business_impact.yaml + pci_scope.yaml + assets.csv",
"asset_id": "POS-01",
"finding_id": "F-002"
},
{
"cve": "CVE-2016-0469",
"state": "before",
"metric": "ModifiedBaseDefaults",
"reason": "Unchanged modified metrics inherit base values unless local evidence overrides them.",
"source": "vulnerabilities.csv",
"asset_id": "POS-01",
"finding_id": "F-002"
},
{
"cve": "CVE-2016-0469",
"state": "after",
"metric": "CR/IR/AR",
"reason": "asset=POS-01 scope_after=in_scope role=payment_processing",
"source": "business_impact.yaml + pci_scope.yaml + assets.csv",
"asset_id": "POS-01",
"finding_id": "F-002"
},
{
"cve": "CVE-2016-0469",
"state": "after",
"metric": "ModifiedBaseDefaults",
"reason": "Unchanged modified metrics inherit base values unless local evidence overrides them.",
"source": "vulnerabilities.csv",
"asset_id": "POS-01",
"finding_id": "F-002"
},
{
"cve": "CVE-2016-3234",
"state": "before",
"metric": "CR/IR/AR",
"reason": "asset=ADMIN-01 scope_before=in_scope role=administration",
"source": "business_impact.yaml + pci_scope.yaml + assets.csv",
"asset_id": "ADMIN-01",
"finding_id": "F-003"
},
{
"cve": "CVE-2016-3234",
"state": "before",
"metric": "ModifiedBaseDefaults",
"reason": "Unchanged modified metrics inherit base values unless local evidence overrides them.",
"source": "vulnerabilities.csv",
"asset_id": "ADMIN-01",
"finding_id": "F-003"
},
{
"cve": "CVE-2016-3234",
"state": "after",
"metric": "CR/IR/AR",
"reason": "asset=ADMIN-01 scope_after=out_of_scope role=administration",
"source": "business_impact.yaml + pci_scope.yaml + assets.csv",
"asset_id": "ADMIN-01",
"finding_id": "F-003"
}
]