---
sidebar_label: "Enable Customer Access to Security Information (Beta)"
---

# Enable Customer Access to Security Information

:::note
The Security Center is Beta. The features and functionality described on this page are subject to change.
:::

The Security Center allows you to provide security information to customers through Enterprise Portal (Classic) or Enterprise Portal (New). The configuration steps and customer experience differ between the two portals.

## Enterprise Portal (Classic)

The **Security Center** tab in Enterprise Portal (Classic) displays security information for each available release version. Customers can:

* View a CVE report with the complete list of known vulnerabilities and their severity levels
* View details about the vulnerabilities identified for each image
* Understand how many CVEs are fixed by upgrading to newer versions
* Download the Software Bill of Materials (SBOM) in SPDX format for compliance and security audits

The following shows an example of the Security Center dashboard in Enterprise Portal (Classic):

![Enterprise Portal (Classic) Security Center dashboard](/images/ep-security-center-dashboard.png)

[View a larger version of this image](/images/ep-security-center-dashboard.png)

### Enable the Security Center in Enterprise Portal (Classic)

The **Security Center** tab is not enabled by default. If the Security Center feature flag is enabled for your team, you can enable the tab for one customer or all customers.

To enable the **Security Center** tab for one customer:

1. In the Vendor Portal, go to **Customers > [Customer] > Enterprise Portal access**.
1. Enable **Enable Security Center for this customer**.

To enable the **Security Center** tab for all customers using Enterprise Portal (Classic):

1. In the Vendor Portal, go to **Enterprise Portal > Portal Settings**.
1. Under **Optional Features**, enable **Enable Security Center**.

## Enterprise Portal (New) (Alpha)

In Enterprise Portal (New), you add a Security page to your content repository. The page can include a release selector, CVE report, and SBOM report. For more information, see [Security components](/vendor/enterprise-portal-v2-content#security-components) in _Customize Enterprise Portal Content_.

Customers can select a release and review CVEs by severity, affected component, and container image. The CVE report identifies the earliest vendor release that resolves each CVE. Customers can also compare the selected release with the latest release, follow links to upgrade affected instances, and download an SBOM. When enabled in the Portal Features settings, customers can also download the raw Grype scan JSON for a release.

Security reports, including raw scan downloads, are available for Helm and Embedded Cluster releases for both online and air gap installations. Customers whose licenses support only KOTS or kURL see a message that security reports are not available.

### Configure Security Center display settings

To configure how Security Center reports display in Enterprise Portal (New):

1. In the Vendor Portal, go to **Enterprise Portal > Content**.
1. Under **Portal Features**, configure **Display only fixable CVEs in Security Center report**:
   * When enabled, customers see only CVEs with an available fix.
   * When disabled, customers can switch between all CVEs and CVEs with an available fix.
1. Configure **Enable raw CVE scan to be downloadable**. This setting is disabled by default:
   * When enabled, the CVE Report card displays **Download full CVE report**. Customers can use this button to download the complete raw Grype scan JSON for the selected release.
   * When disabled, the button is not displayed. Customers can still view the CVE report when they have access to the Security Center.

Changes to the Portal Features settings are saved automatically.

The downloaded JSON contains the same raw Grype scan data that is available to vendors through the [`securebuild/scan-raw` Vendor API endpoint](/vendor/security-center-retrieve-scan-results#retrieve-the-raw-scan-results). The customer-facing download is controlled by this setting and is distinct from both Vendor API access and the SPDX SBOM download.

### Enable Security Center for a customer

The Portal Features settings control how Security Center reports display; they do not grant Security Center access to individual customers. To grant access:

1. In the Vendor Portal, go to **Customers > [Customer] > Enterprise Portal access**.
1. If **Portal Version** is available, set it to **Use new Enterprise Portal for this customer**.
1. Enable **Enable Security Center for this customer**.

### Add a Security page to the content repository

Add a page containing the Security Center components to each applicable version branch in your content repository. Include the page in `toc.yaml` so that customers can open it from the portal navigation. For more information, see [Table of contents](/vendor/enterprise-portal-v2-content#table-of-contents) in _Customize Enterprise Portal Content_.