Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

GRC · Risks · Stakeholders · Frameworks · The graph · From the network

Stakeholders: a register for each, at every scale

53 stakeholders in one tree, from everyone with PHP in the path down to the roles inside a single organisation. Each has a register: the risks assigned to it, and the risks that arrive through the parts beneath it. The register belongs to the stakeholder, so it reads the same whether the stakeholder is a sector, a council or a CISO.

Stakeholder	Kind	Assigned here	In its register
Everyone with PHP in the path	domain	1	34
The PHP project	group	3	11
The PHP security team	team	7	7
The fix authors	team	1	1
The PHP Foundation	organisation	3	3
The finders	group	4	7
Calif	organisation	1	1
OpenAI (Patch the Planet)	organisation	1	1
Wiz Research	organisation	1	1
Quarkslab and OSTIF	organisation	1	1
Distributors and packagers	group	2	3
Chainguard	organisation	1	1
Linux distributions and image builders	group	1	1
Hosting panels and paid long-term support	group	1	1
Software built on PHP	group	0	4
Suppliers in the NCSC-NL inventory	group	3	3
Open-source PHP applications	group	1	1
Hosting and cloud providers	group	1	4
Managed PHP platforms	group	2	2
Shared and self-service hosting	group	1	1
Edge, WAF and detection vendors	group	2	8
WAF vendors	group	2	2
Threat intelligence and detection	group	4	4
Agencies and CERTs	group	3	11
US: CISA and the NSA	group	2	2
EU and member-state CERTs	group	5	5
UK NCSC	organisation	1	1
Organisations running PHP	group	9	26
Governments and public services	group	1	3
Local councils	group	1	1
National governments	group	1	1
Critical infrastructure providers	group	2	2
Online shops and payments	group	2	2
Banks, insurers and financial entities	group	1	1
Wikis, universities and non-profits	group	0	0
Inside any one organisation	group	0	22
Board and executives	role	5	5
CISO	role	2	2
CTO	role	3	3
CFO	role	1	1
Security lead and AppSec	role	6	6
Platform engineers and developers	role	4	4
Website owner	role	2	2
Communications team	role	2	2
Data protection officer	role	2	2
People who use PHP services	group	1	5
People whose data is held in PHP applications	group	2	2
People who need a service that went offline	group	2	2
The press	group	2	6
This newsroom	organisation	1	5
The editor	role	4	4
The newsroom's agents	group	4	4
This site's readers	group	3	3

How the stakeholders are connected

The number in a cell is how many risks the two groups share: a risk assigned to someone in one and someone in the other. A risk that joins many groups is one no single party can treat alone.

	PHP	finders	Distributors	Software	Hosting	Edge,	Agencies	Organisations	People	press
The PHP project	·	6	2	1	2	2	2	7	1
The finders	6	·	1			1		4		1
Distributors and packagers	2	1	·					2
Software built on PHP	1			·			2	4
Hosting and cloud providers	2				·	1	1	4	2
Edge, WAF and detection vendors	2	1			1	·	3	7	1
Agencies and CERTs	2			2	1	3	·	11	4	1
Organisations running PHP	7	4	2	4	4	7	11	·	5	2
People who use PHP services	1				2	1	4	5	·
The press		1					1	2		·