HARTEN · WAYFINDER
Continuous Systems Intelligence
Connect vulnerability and deprecation findings to the applications, business processes and dependencies they affect.
Harten is developing Wayfinder CSI to use existing application documentation, specifications and supporting evidence alongside current security advisories and lifecycle information. The aim is to show where a finding applies, what a change could affect and what still needs checking.
Build on the application knowledge already recovered
A dependency alert tells a team which component needs attention. The application documentation can help explain where that component is used, the information it handles and the processes that depend on it. The specification adds the behaviour that an upgrade or replacement must preserve.
CSI is designed to connect that material with dated external evidence. Resolved dependency inventories, build records and deployment information would establish which versions are present. Vendor advisories and support policies would establish the issue or deadline. Existing scanners can contribute findings to the same view.
The result should help teams assess an application or a wider estate without treating every finding as an isolated ticket.
The proposed CSI views
A graph shows the relationships behind a finding: the component, its evidence, the application paths that depend on it and the work needed to respond.
Connect a published advisory to an observed component version, then examine the application paths, deployment conditions and business processes that may be affected.
Which systems need attention, and what evidence supports the assessment?
A version match is a finding to assess. It does not, on its own, establish exploitability. Missing runtime evidence remains an open question.
Connect deprecated APIs, superseded dependencies and support deadlines to their callers, affected behaviours and candidate replacements. Keep each lifecycle status distinct.
What needs changing, what depends on it, and what must keep working?
An end-of-support date is not proof of failure. A deprecation notice is not automatically a security advisory.
Illustrative graph concepts, not screenshots or findings from a completed CSI assessment. Solid lines show the intended relationships; dashed lines mark evidence to confirm for a particular assessment.
Check the foundation in the published work
The public PRSD-IWS analysis contains relationships CSI could use. These examples validate the available application context; they do not establish vulnerability or end-of-support findings.
The documentation connects OWIN authentication, OAuth tokens, claims and request handling. CSI could connect a relevant component finding to those paths, while retaining questions about effective deployment and access rules.
Read the security and trust-boundary chapter →The source-derived documentation identifies Serilog and Polly-related retry support in the client configuration. That gives an upgrade assessment concrete behaviour to investigate, while the production log destination and retry settings still require confirmation.
Read the deployment and operations chapter →The integration catalogue connects handlers, repositories, Entity Framework and SQL Server to notification and assessment work. It also records reporting procedures and caches. Those relationships help identify what a data-access change would need to preserve and test.
Read the integration catalogue →Independent Harten analysis of publicly available source. It is not a DEFRA-commissioned engagement or an assessment of the live service. Exact installed versions, current advisories and operational exposure require their own evidence.
An external example · October 2026
On 21 October 2026, PHP published fixes for two critical remote-code-execution vulnerabilities and urged users to update installations serving web requests. Its guidance distinguishes runtime configurations and distributor-provided fixes. Read PHP’s security announcement.
A useful assessment must connect that advisory to the runtime and build actually deployed, the applications it serves and evidence that the fix reached those environments. Application documentation supplies context; it cannot establish those operational facts by itself.
CSI is intended to maintain those connections and the review actions needed to complete them. An incomplete application graph must not be treated as evidence that a vendor’s urgent patch guidance does not apply.
Different findings need different responses
A component can have several of these characteristics at once. CSI’s proposed classifications preserve the reason for a finding and the evidence behind it.
PHP 8.2 deprecated creating dynamic properties, with documented exceptions. The relevant finding needs to identify the property use, applicable class behaviour and target PHP release. It is a migration question, rather than proof that the application is vulnerable.
Sources: PHP’s deprecation guide, PHP’s support policy, Composer’s abandonment metadata and CycloneDX’s explanation of vulnerability context.
The purpose of continuous assessment
A new advisory can matter even when the application has not changed. A deployment can change the affected version. A support deadline can create work before anything breaks.
The intended service would reuse compatible application artefacts, refresh the relevant external evidence and retain the history of findings, reviews and actions. Each assessment should show its source revision, observed versions, evidence dates, coverage and unresolved questions. Test-only dependencies should remain distinguishable from deployed components.
Current status: Wayfinder’s published documentation and specifications demonstrate the application-evidence foundation. CSI’s vulnerability and deprecation graphs, integration and automated continuous operation are in development. Coverage, delivery scope and availability will be confirmed for an agreed engagement.
Discuss the product direction with Harten
Tell us about the applications or estate you support, the dependency or security questions you need to answer, and the evidence you already have. We can discuss suitability and the scope of an assessment.