Security

The Security tab is the second risk axis. It opens on a compliance-framework selector, and what it renders depends on that choice.

Misconfigurations

With the framework set to none, you get the misconfiguration findings table: workload and cluster configuration that is unsafe independent of any framework — privileged containers, host namespace sharing, writable root filesystems, missing security contexts, over-broad RBAC.

Vulnerabilities

The Vulnerabilities view lists image CVEs:

Column	What it shows
Severity	Critical / High / Medium / Low, as a pill.
CVE	The identifier, with copy-to-clipboard.
Package	With an ecosystem badge — the OS or language package manager it came from.
Version	Installed → fixed, shown as a diff, so you can see whether a fix even exists.
Target	The image layer or artifact the finding is in.
Workload	Which running workload actually uses that image.

Severity summary cards sit above, and search plus a segmented filter narrow the table.

Never scanned is not the same as clean

If a cluster has never been scanned, the view says so. It does not report zero findings — a zero that means “we did not look” is the most dangerous number this product could show you.

Selecting a finding opens a remediation drawer with the fix.

Compliance

Pick a framework (CIS and friends) and the tab becomes a scorecard:

• A compliance score ring.
• Summary cards — failed controls, total findings, passing controls.
• A severity distribution bar.
• A filterable, sortable, paginated controls table, each control expandable into the individual findings behind it.

Rescan

Both the misconfiguration and CVE views can request a rescan from the tab. Scan settings live in cluster settings and need Cluster Maintainer or above — see Access.

From the CLI

rtz risk security
rtz risk cve
rtz risk compliance