<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Risk Assessment (NIST 800-30) — API Reference

## Vulnerability Scanning

```bash
# Nmap vulnerability detection
nmap -sV --script vulners -oX vuln-scan.xml <TARGET>

# Trivy container scanning
trivy image --severity HIGH,CRITICAL --format json <IMAGE>

# OpenVAS CLI scan
gvm-cli --gmp-username admin --gmp-password pass \
  socket --socketpath /var/run/gvmd.sock \
  --xml '<start_task task_id="TASK_ID"/>'
```

## Threat Intelligence Sources

```bash
# NVD CVE lookup
curl "https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=<KEYWORD>"

# CISA Known Exploited Vulnerabilities
curl "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"

# AWS GuardDuty findings
aws guardduty list-findings --detector-id <ID> --output json
```

## Risk Scoring Matrix

| Likelihood \ Impact | Very Low (1) | Low (2) | Moderate (5) | High (8) | Very High (10) |
|---------------------|-------------|---------|-------------|----------|---------------|
| Very High (10) | 10 | 20 | 50 | 80 | 100 |
| High (8) | 8 | 16 | 40 | 64 | 80 |
| Moderate (5) | 5 | 10 | 25 | 40 | 50 |
| Low (2) | 2 | 4 | 10 | 16 | 20 |
| Very Low (1) | 1 | 2 | 5 | 8 | 10 |

## Risk Response Options

```
Risk Response Strategies (NIST 800-39):
├── Mitigate: Implement controls to reduce likelihood/impact
├── Accept: Acknowledge and monitor (within risk appetite)
├── Transfer: Insurance, outsourcing, contractual liability
├── Avoid: Eliminate the activity that creates the risk
└── Share: Distribute risk across multiple parties
```
