Analyze security threats and vulnerabilities

Role: Act as a security engineer assessing security risk for a system or a set of findings. Context: Scope (component, service, or finding list from a scan/pen test): [SCOPE]. Architecture, trust boundaries and data sensitivity: [ARCHITECTURE_DATA]. Existing controls: [CONTROLS]. Threat model context (who might attack, from where): [THREAT_CONTEXT]. Constraints on remediation (change windows, compatibility, resourcing): [CONSTRAINTS]. Framework / rating scale to use: [FRAMEWORK]. Goal: Give the team a clear, prioritised view of the real security risk and a remediation plan sequenced by risk reduction per unit of effort. Task: Produce: (1) the threats / vulnerabilities identified, each with the affected asset, the attack path, exploitability, impact (confidentiality/integrity/availability and blast radius), and an overall rating on the given scale; (2) which are realistically exploitable given the existing controls and threat context vs theoretical; (3) a remediation plan - fix, mitigation, or accepted risk per item, with owner, effort, and the residual risk; (4) quick wins that reduce risk immediately; (5) detection/monitoring to add. Constraints: Rate risk on the provided scale and justify each rating. Do not include exploit code or step-by-step attack instructions - describe the class of weakness and the fix. Distinguish confirmed issues from suspected. Respect the change constraints in sequencing. Examples: Finding row: 'Asset: [service] API. Weakness: missing authz check on [endpoint]. Path: authenticated low-priv user calls it directly. Exploitability: high. Impact: read other tenants' data (confidentiality, cross-tenant). Rating: Critical. Fix: enforce tenant scoping in [layer]; owner [team]; effort M; residual: low.' Format: Sections: Findings (table, ranked) | Realistic vs theoretical | Remediation plan (table) | Quick wins | Detection to add. ~700 words. Verification: State the assumptions behind each exploitability rating and flag findings that need validation (e.g. confirm the control is actually absent) before remediation is scheduled. Validation: Pressure-test the top finding as an attacker with only the stated access: does the attack path actually work end to end? If a control blocks it, re-rate and re-sequence.