Periodic Table
The software supply chain, laid out so position means something.
Twenty-five domains, 236 controls, laid out in the order the chain runs. Open one to see its controls arranged by the program maturity each demands, how much of the modeled threat it closes, and who actually sells it.
Table
← All 25 domains
14Runtime Application Validation
8 of 10 shown
Do we test our running applications and exposed surfaces often enough to find what attackers would find first — and verify our fixes actually work?
Attacks counteredlow to high
- Counters none5
- Counters 1–23
- Counters 3–50
- Counters 6+0
Level 2
2 here
Level 3
6 here
- Af135API Fuzzing0 attacks countered
- Ads136Authenticated DAST Scanning1 attacks countered
- Apt137Automated Penetration Testing0 attacks countered
- Bbv138Bug Bounty & Vulnerability Disclosure Program0 attacks countered
- Ev139Exploitability Validation0 attacks countered
- Ias140Interactive Application Security Testing1 attacks countered
How this was produced
Every figure above was read from the Gantry knowledge graph, version 7.1.0, and computed when you opened this page — in 408 ms on 2026-10-27. Nothing here is a cached verdict or a dataset assembled for marketing: it is the same model our engagements run on.