For each zone and conduit, vulnerabilities are identified from vulnerability assessments, prior audits and vulnerability databases, including the assumption that unknown and unpatched vulnerabilities exist in the attack surface the zone exposes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.