Dashboard
The Dashboard is the landing page for Inspector after setup completes. It summarizes every active vulnerability finding Prism has cached across your enrolled accounts and regions, breaks them down by severity, ranks the CVEs that account for the most findings across your estate, and then breaks the same findings down by type and by account.
Accessing the Dashboard
In the Security Hub sidebar, click Amazon Inspector. If Inspector is enabled, you land directly on the Dashboard.
Header
The header summarises the deployment on one line: the home region, how many accounts are enrolled across how many regions, and Last refresh as a relative time such as 2 min ago, or never when no refresh has completed yet. After a clean refresh it also reports how many findings were fetched. Alongside it sits a Refresh findings button that fetches the latest findings from AWS.
If the configuration is in partial failure, a warning banner appears above the tiles reading "Some accounts are not fully enrolled in Amazon Inspector", followed by the error, with a Review button through to Enrollment, where the affected accounts are listed.
The Dashboard reads from Prism's cache of the last refresh, not live AWS data. Click Refresh findings to fetch current findings. If a refresh started elsewhere is already running when you open the page, the Dashboard detects it and picks up its progress rather than showing an idle page; the button reads Refreshing… and is disabled, with a Refresh already in progress tooltip on hover.
Severity Tiles
Six tiles break down your active findings by severity:
| Tile | Meaning |
|---|---|
| Critical | Critical severity active findings |
| High | High severity active findings |
| Medium | Medium severity active findings |
| Low | Low severity active findings |
| Informational | Findings AWS classified as informational |
| Untriaged | Findings AWS has not yet assigned a severity to |
If AWS ever returns a severity label Prism does not recognise, it gets a tile of its own rather than being dropped, so the breakdown always sums to the total printed beneath it.
Click any tile to open the Findings page pre-filtered to that severity. A line beneath the tiles gives the Total active findings across all severities, summed over every tile so the breakdown and the total can never disagree.
Untriaged is not the same as informational. UNTRIAGED means Amazon Inspector has not yet assigned a severity to the finding, not that the finding is unimportant. A critical vulnerability can sit in Untriaged while AWS is still scoring it. Treat the tile as a queue to review, not as noise to ignore. The Untriaged and Informational tiles carry a tooltip saying as much.
Coverage and Fix Stats
Beneath the severity breakdown, three coverage tiles appear in this order:
| Stat | Meaning |
|---|---|
| Fixes available | How many active findings AWS reports a published vendor fix for. Findings AWS marks as only partially fixed are not counted here |
| Accounts covered | How many accounts are enrolled and scanning. This is counted from the enrolled accounts, not from the findings, so an enrolled account with zero findings still counts as covered |
| Regions covered | How many linking regions have an enabled scan, counted the same way |
Fixes available is the practical prioritisation signal: those findings can be remediated today by applying an available update, whereas the remainder are waiting on a vendor.
Accounts covered and Regions covered are clickable, opening Enrollment and Settings respectively. Fixes available is deliberately not clickable, because the findings list has no fix-available filter and the click would open an unfiltered list that misrepresents the number.
A caption below the row lists the Resource types scanned, or none selected when the configuration has none.
Top CVEs
The Top CVEs table ranks the most prevalent vulnerabilities across your estate, so you can patch the ones with the widest blast radius first. It is capped at the ten highest-count CVEs, and the card header shows how many are currently listed. For each CVE it shows:
| Column | Description |
|---|---|
| CVE | The CVE identifier |
| Findings | How many active findings reference this CVE across all accounts and regions |
| Max score | The highest Inspector score recorded for this CVE anywhere in your estate. An em dash means AWS reported no score |
| Fix available | Yes, Partial, or No |
Select a CVE row to open the Findings page with that CVE identifier in the title search.
Fix available here is a roll-up across every finding for that CVE, not a single AWS value. Yes means at least one of them has a vendor fix, Partial means some do and some do not, and No means none do yet. Each chip carries a tooltip saying which.
Findings by Type
A breakdown of active findings by Inspector finding type, in a Type and Count table ordered by count, highest first. The types are:
| Type | Meaning |
|---|---|
PACKAGE_VULNERABILITY | A known CVE in an installed software package or dependency |
NETWORK_REACHABILITY | An unintended network path exposing a resource |
CODE_VULNERABILITY | Insecure code found in your own Lambda source or a linked repository |
Select a type row to open the Findings page filtered to it.
Only PACKAGE_VULNERABILITY findings carry a CVE identifier, and only some findings carry an Inspector score. NETWORK_REACHABILITY findings legitimately have no score; the Dashboard and finding detail render an absent score as an em dash rather than as zero.
Per-Account Findings
A table of every account with active findings, with an Account column and an Active findings count, ordered by count, highest first. Select an account row to open the Findings page filtered to that account. Accounts that are enrolled but currently have no active findings do not appear here; use Enrollment to see the full enrolled list.
Refreshing Findings
Click Refresh findings to fetch the latest findings from AWS for every enrolled account and region. The button reads Refreshing… and is disabled while the job runs, with a Refresh already in progress tooltip on hover.
While it runs, a progress bar appears beneath the header with a caption reading how many findings have been fetched so far, and how many accounts could not be reached if any have failed. Because Inspector counts its account-and-region work units up front, the bar is exact rather than an estimate.
A refresh caches only the findings AWS currently reports as active, and it removes cached findings that AWS no longer reports. That means remediated vulnerabilities drop out of the Dashboard on the next refresh rather than lingering, and the counts reflect your current posture rather than accumulated history.
Pruning only happens for units the refresh walked completely. If a refresh is cut short for an account or region, Prism keeps that unit's existing rows rather than deleting findings it simply did not reach, so an interrupted refresh never looks like a sudden improvement in posture.
Partial and Failed Refreshes
Because each account is fetched independently, a refresh finishing with gaps is a normal outcome rather than a failure. When that happens a warning banner reports "Refresh finished with gaps", how many findings were fetched, how many accounts were unreachable, and how many account-region units went unscanned, and states that the counts below cover only what was scanned.
If the refresh job fails outright, an error panel replaces the progress bar with the job's error message and a retry action.
Empty States
- Amazon Inspector is not configured, shown with a Reload button when Inspector is disabled for the organization, including when it is disabled in another tab while this page is open.
- No CVEs recorded yet, shown in the Top CVEs table when no findings carrying a CVE are cached. Only package-vulnerability findings carry one, network-reachability findings never will.
- No findings detected yet, shown in the Findings by type table when Inspector is enabled and refreshed but no active findings exist. Inspector needs time after enablement to discover and scan resources, so this immediately after setup is expected.
- No accounts with active findings, shown in the per-account table under the same conditions.
Related Pages
- Findings, Browse and filter the full findings list
- Enrollment, Check which accounts are enrolled and retry failures
- Settings, Change scan types and regions
- Security Hub Issues, Troubleshooting refresh problems