Business service risk: model and report executive risk by business service

[FrodeHus]

Goal

Let executives see which business services are at material vulnerability risk, including service owner, risk level, critical exposure count, SLA breaches, and trend.

Current state

• PatchHound has BusinessLabel/DeviceBusinessLabel and device group risk rollups, but no first-class business service risk model or dashboard section.
• The current executive UI shows highest-pressure device groups, which is useful but not the same as business-service impact.

Scope

• Decide whether business services extend existing business labels or need a dedicated entity.
• Map devices/software/cloud apps to one or more business services.
• Compute service-level risk from open exposures, asset criticality, tenant risk scores, ownership, SLA breach state, and threat assessment signals.
• Add API/UI for top risky business services with drill-down to technical evidence.

Acceptance criteria

• A business service can have owner/team, criticality, and mapped assets/software/cloud apps.
• Dashboard returns top risky services with current risk, critical/high counts, overdue count, owner, and trend.
• Drill-down can show contributing vulnerabilities/assets.
• Tests cover multi-asset service rollup, unmapped assets, and tenant isolation.