Cortex
Cortex distribution is live: after every scan, Vibgrate best-effort pushes DriftScore, risk level, and top remediation into the matching Cortex entity's custom data, keyed on the same repository identity used everywhere else. RiskScore and the derived DriftRisk™ follow in a second push once the SCA pipeline computes them for that scan.
What's live today
Cortex connections push a canonical score payload (DriftScore, risk level, EOL count, top risk, trend, top remediation, deep link) into POST /api/v1/catalog/{entity-tag}/custom-data. A fast push fires right after the scan with DriftScore; RiskScore and DriftRisk™ are added in a second, enriched push once the SCA pipeline computes RiskScore for that scan (they're null, never a fabricated 0, until then). Each connection has a Score types setting — DriftScore only, DriftRisk only (nothing until RiskScore is real), or both (default) — so a connection that only wants DriftScore never even receives the enriched push, and a DriftRisk-only connection never receives the drift-only one. Pushes run automatically after a scan and on demand via a manual sync. Credentials are encrypted at rest and never returned by read endpoints. Failures never block scanning — they're logged and surfaced separately.
See the Enterprise Integration Plan for how this same payload builder extends to Slack, Datadog, and other push targets.