AttackForge
Search
⌃K
Comment on page

Access Control Matrix

Application User Roles

Function
Admin
Project Coordinator
Library Moderator
Client / Consultant
Global Dashboard
​
​
​
​
  • has full access to this module
Yes
Yes
Yes
Yes
Analytics
​
​
​
​
  • can filter analytics on their data
Yes
Yes
Yes
Yes
Vulnerabilities
​
​
​
​
  • can filter their vulnerabilities
Yes
Yes
Yes
Yes
Portfolios
​
​
​
​
  • has full access to this module including CRUD operations
Yes
No
No
No
  • has view access to Portfolio(s)
Yes
Based on configuration
Based on configuration
Based on configuration
  • has view access to Stream(s)
Yes
Based on configuration
Based on configuration
Based on configuration
Projects
​
​
​
​
  • can view projects they have access to
Yes
Yes
Yes
Yes
  • can access all projects by default
Yes
No
No
No
  • can perform all workflows on a project by default
Yes
No
No
No
  • can create new projects
Yes
Yes
No
No
  • can update projects
Yes
Yes (for projects user has access to)
No
No
  • can archive & unarchive projects
Yes
No
No
No
  • can destroy projects
Yes
No
No
No
  • can invite users to projects
Yes
Yes (for projects user has access to)
No
No
  • can manage user access to projects
Yes
Yes (for projects user has access to)
No
No
  • can request new projects & update own project requests
Yes
Yes
Yes
Yes
  • can access all pending & actioned project requests
Yes
Yes
No
No
  • can approve/reject/request info for all pending project requests
Yes
Yes
No
No
Scheduling
​
​
​
​
  • can see own projects
Yes
Yes
Yes
Yes
  • can see all projects
Yes
No
No
No
Assets (if enabled)
​
​
​
​
  • can create new assets
Yes
Yes
Yes
Yes
  • can see own assets
Yes
Yes
Yes
Yes
  • can see all assets
Yes
Yes
Yes if user has Edit access to at least 1 project
Yes if user has Edit access to at least 1 project
  • can update own assets
Yes
Yes
Yes
Yes
  • can update all assets
Yes
Yes
No
No
  • can delete own assets
Yes
Yes
Yes
Yes
  • can delete all assets
Yes
Yes
No
No
  • can view linked projects & groups on assets
Yes
Yes
No
No
  • can view vulnerabilities on assets
Yes
Yes only for vulnerabilities user has access to
Yes if user has Edit access to at least 1 project and only for vulnerabilities user has access to
Yes if user has Edit access to at least 1 project and only for vulnerabilities user has access to
Writeups
​
​
​
​
  • can create/read/update/delete writeups in Main Library
Yes
Based on configuration
Based on configuration
Based on configuration
  • can create/read/update/delete writeups in Imported Library
Yes
Based on configuration
Based on configuration
Based on configuration
  • can create/read/update/delete writeups in Project Library
Yes
Based on configuration
Based on configuration
Based on configuration
  • can create/read/update/delete writeups in Custom Libraries
Yes
Based on configuration for each library
Based on configuration for each library
Based on configuration for each library
  • can create/read/update/delete vulnerabilities in All Libraries
Yes
No
No
No
  • can create/read/update/restore vulnerabilities in Deleted Library
Yes
No
No
No
Test Suites
​
​
​
​
  • has full access to this module, including CRUD operations
Yes
Yes
No
No
Groups
​
​
​
​
  • has full access to this module, including CRUD operations
Yes
No
No
No
Users
​
​
​
​
  • has full access to this module, including CRUD operations
Yes
No
No
No
Self-Service API
​
​
​
​
  • can generate own API key
Yes
Yes
Yes
Yes
  • can access SSAPI RESTful endpoints/methods
Yes (for APIs user has been given access to)
Yes (for APIs user has been given access to)
Yes (for APIs user has been given access to)
Yes (for APIs user has been given access to)
  • can access SSAPI Events
Yes (for APIs user has been given access to)
Yes (for APIs user has been given access to)
Yes (for APIs user has been given access to)
Yes (for APIs user has been given access to)
Attack Chains
​
​
​
​
  • has full access to this module
Yes
Yes
Yes
Yes
Administration
​
​
​
​
  • has full access to this module, including CRUD operations
Yes
No
No
No

Project Privileges

Function
Admin
Project Coordinator
Edit
Upload
View
Project
​
​
​
​
​
  • can view project dashboard
Yes
Yes
Yes
Yes
Yes
  • can invite users to project
Yes
Yes
No
No
No
  • can view project team and project group members
Yes
Yes
Yes
No
No
  • can edit project
Yes
Yes
Yes, only following: start date, end date, set & modify additional email recipients for daily start/stop testing + new vulnerability discovered emails, update custom fields
No
No
  • can place project on-hold / off-hold
Yes
No
Yes
No
No
  • can add custom tags
Yes
Yes
Yes
No
No
  • can delete / archive project
Yes
Yes
No
No
No
  • can view project logs
Yes
Yes
No
No
No
Scope / Assets
​
​
​
​
​
  • can view project scope/assets
Yes
Yes
Yes
Yes
Yes
  • can create, update & delete scope/assets
Yes
Yes
Yes
No
No
  • can see all assets in Assets module (to be able to assign assets/scope to project)
Yes
Yes
Yes
No
No
Testing
​
​
​
​
​
  • can view test cases and execution flows
Yes
Yes
Yes
Yes
Yes
  • can update test cases, including actioning, adding notes & uploading evidence, adding workspace notes and files
Yes
No
Yes
No
No
  • can assign assets/users to test cases on a project
Yes
No
No
No
No
  • can lock/unlock/delete test cases on a project
Yes
Yes
No
No
No
  • can send daily start / stop testing email notifications
Yes
No
Yes
No
No
Retesting
​
​
​
​
​
  • can mark vulnerabilities as ready for retest
Yes
Yes
Yes
Yes
Yes
  • can request a retest
Yes
Yes
Yes
Yes
Yes
  • can confirm retest is completed
Yes
No
Yes
No
No
  • can view retesting history on project
Yes
Yes
Yes
Yes
Yes
Vulnerabilities
​
​
​
​
​
  • can view all vulnerabilities (except for vulnerabilities in pending status)
Yes
Yes
Yes
Yes
Yes
  • can view pending vulnerabilities
Yes
Yes
Yes
No
No
  • can update & delete vulnerabilities
Yes
No
Yes
No
No
  • can view remediation notes
Yes
Yes
Yes
Yes
Yes
  • can add remediation notes
Yes
Yes
Yes
Yes
Yes
  • can view, create & reply to review notes
Yes
No
Yes
No
No
  • can view revision history
Yes
No
Yes
No
No
  • can import vulnerabilities from tools & API
Yes
No
Yes
No
No
  • can export vulnerabilities to JIRA / ServiceNow / Azure DevOps / Kenna Security / Nucleus Security
Yes
Yes
Yes
Yes
Yes
  • can update SLA
Yes
Yes
No
No
No
  • can re-apply SLA
Yes
Yes
No
No
No
  • can remove SLA
Yes
Yes
No
No
No
  • can update remediation plan
Yes
Yes
Yes
Yes
Yes
Attack Chains
​
​
​
​
​
  • can view attack chains
Yes
Yes
Yes
Yes
Yes
  • can create, update, re-order, duplicate and delete attack chains
Yes
No
Yes
No
No
Reporting
​
​
​
​
​
  • can download standard reports - PDF / DOCX / HTML / CSV
Yes
Yes
Yes
Yes
Yes
  • can customise standard reports
Yes
Yes
Yes
Yes
Yes
  • can download JSON export for report
Yes
Yes
Yes
Yes
Yes
  • can download evidence in ZIP archive
Yes
Yes
Yes
Yes
Yes
  • can download custom reports
Yes
Yes
Yes
Yes
Yes
  • can view executive summary
Yes
Yes
Yes
Yes
Yes
  • can update executive summary
Yes
No
Yes
No
No
  • can view, create & reply to executive summary review notes
Yes
No
Yes
No
No
Daily Tracking
​
​
​
​
​
  • can view schedule and tracking
Yes
Yes
Yes
Yes
Yes
Collaboration
​
​
​
​
​
  • can view project team member profiles
Yes
Yes
Yes
Yes
Yes
Workspace
​
​
​
​
​
  • can upload files to the project workspace
Yes
No
Yes
Yes
No
  • can create, update & delete workspace notes & files