@@ -343,10 +343,13 @@ def build(db, asset, scan, user=None, organization: str = "") -> dict:
                                + base64.b64encode(p.read_bytes()).decode())
         findings.append(f)
     overall = score(findings, triaged)
-    # Risk, deterministic: likelihood x breachability, weighted by exposure.
-    from app.core import dast_precedent, dast_risk
+    # Risk, deterministic: likelihood x breachability, weighted by exposure and
+    # by the data the app holds (derived from the code linked to this site).
+    from app.core import data_classification, dast_precedent, dast_risk
 
-    dast_risk.annotate(findings, getattr(asset, "exposure", "") or "")
+    data_profile = data_classification.profile_for_asset(db, asset)
+    dast_risk.annotate(findings, getattr(asset, "exposure", "") or "",
+                       data_profile["classes"])
     # The verified real world precedent for each weakness class, from the vetted
     # table, so the report shows a factual comparable case even with no AI triage.
     dast_precedent.annotate(findings)
@@ -443,7 +446,7 @@ def build(db, asset, scan, user=None, organization: str = "") -> dict:
     return {
         "asset": asset, "scan": scan, "view": view, "findings": findings,
         "overall": overall, "by_sev": by_sev, "categories": categories,
-        "risk_matrix": risk_matrix,
+        "risk_matrix": risk_matrix, "data_profile": data_profile,
         "reachable_sinks": reachable_sinks, "context_sinks": context_sinks,
         "heat_max": heat_max, "triaged": triaged, "ai_summary": ai_summary,
         "narrative": narrative(asset.host, view, overall, by_sev, triaged, profile_words),
 
@@ -65,8 +65,9 @@ def likelihood(f: dict) -> tuple:
     return base, why
 
 
-def breachability(f: dict, exposure: str = "") -> tuple:
-    """1..5 and a short basis: what a hit yields, weighted by exposure."""
+def breachability(f: dict, exposure: str = "", data_classes=None) -> tuple:
+    """1..5 and a short basis: what a hit yields, weighted by exposure and by
+    the kind of data the application holds."""
     text = f"{f.get('title') or ''} {f.get('cwe') or ''} {f.get('evidence') or ''}"
     reasons = []
     if _RCE.search(text):
@@ -90,6 +91,13 @@ def breachability(f: dict, exposure: str = "") -> tuple:
     if _SENSITIVE_URL.search(str(f.get("url") or "")):
         impact = min(5, impact + 1)
         reasons.append("a sensitive endpoint")
+    if data_classes:
+        from app.core import data_classification
+
+        bump, why = data_classification.impact_bump(data_classes)
+        if bump:
+            impact = min(5, impact + bump)
+            reasons.append(why)
     return impact, "; ".join(reasons)
 
 
@@ -143,11 +151,11 @@ def corroborate(findings: list, reachable_sinks: list) -> int:
                  "low": "low", "info": "low", "none": "low"}
 
 
-def annotate(findings: list, exposure: str = "") -> list:
+def annotate(findings: list, exposure: str = "", data_classes=None) -> list:
     """Add likelihood, breachability, risk and a basis to each finding, in place."""
     for f in findings:
         lk, lk_why = likelihood(f)
-        br, br_why = breachability(f, exposure)
+        br, br_why = breachability(f, exposure, data_classes)
         f["likelihood"] = lk
         f["breachability"] = br
         f["likelihood_label"] = LIKELIHOOD_LABEL[lk]
 
@@ -0,0 +1,184 @@
+"""What data an application likely holds, and what a breach of it would mean.
+
+The dynamic scan sees a web site from the outside.  The code behind it, and the
+tags people already put on those repositories, say what the application handles:
+customer records, personal data, payment cards, health data, financial reporting
+data under SOX, controlled unclassified information.  That classification is the
+other half of risk.  A weakness on an app that holds SOX or card data is a
+bigger breach than the same weakness on a brochure site, and the report should
+say so, in the real terms a public company cares about: fines, breach
+notification, reputational loss.
+
+This module derives that profile from the repositories linked to a DAST asset,
+reusing the sensitivity labels, application name and repository name that the
+tagging already maintains, and turns it into an impact weight and a plain
+consequence.  It is deterministic: a keyword read of tags that already exist, so
+the report can state the consequence as fact, not a guess dressed up as one.
+
+Even a mailing address counts: it is personal data, and in a federal context it
+can be controlled unclassified information.  So the classes run from the plainly
+regulated down to ordinary customer data, and ordinary customer data still
+matters.
+"""
+
+from __future__ import annotations
+
+import re
+
+# Each class: a label, how much it raises the impact of a breach (0 to 2), and
+# the plain consequence a reader should understand.  Ordered most serious first,
+# which is the order a dominant class is picked in.
+CLASSES = {
+    "sox": {
+        "label": "SOX financial reporting data",
+        "bump": 2,
+        "consequence": "For a publicly traded company a breach here can mean "
+                       "regulatory fines and a failure of financial reporting "
+                       "controls.",
+    },
+    "pci": {
+        "label": "payment card data",
+        "bump": 2,
+        "consequence": "Exposure can bring payment card brand penalties and the "
+                       "loss of the ability to process cards.",
+    },
+    "phi": {
+        "label": "health information",
+        "bump": 2,
+        "consequence": "Exposure can bring HIPAA penalties and mandatory breach "
+                       "notification.",
+    },
+    "cui": {
+        "label": "controlled unclassified information",
+        "bump": 2,
+        "consequence": "Exposure can breach federal handling rules for controlled "
+                       "unclassified information; even a mailing address can be CUI.",
+    },
+    "spii": {
+        "label": "sensitive personal data",
+        "bump": 2,
+        "consequence": "Exposure of data such as Social Security or financial "
+                       "numbers triggers breach notification laws and identity "
+                       "theft risk.",
+    },
+    "pii": {
+        "label": "personal data",
+        "bump": 1,
+        "consequence": "Exposure triggers privacy law obligations and direct harm "
+                       "to the people whose data it is.",
+    },
+    "customer": {
+        "label": "customer data",
+        "bump": 1,
+        "consequence": "A breach exposes customers and brings reputational loss.",
+    },
+    "credentials": {
+        "label": "credentials or secrets",
+        "bump": 1,
+        "consequence": "Exposed credentials let an attacker reach whatever they "
+                       "unlock.",
+    },
+}
+
+ORDER = ["sox", "pci", "phi", "cui", "spii", "pii", "customer", "credentials"]
+
+# Keywords that place a tag, application name or repository name into a class.
+# Read case insensitively over text people already wrote, so it is a floor, not
+# a guess: a match means the word is there.
+_KEYWORDS = {
+    "sox": r"\bsox\b|sarbanes|financial report|general ledger|\bg/?l\b|\berp\b|"
+           r"e-?business suite|\bebs\b|revenue recognition|accounts (payable|receivable)|"
+           r"\bledger\b|audit trail",
+    "pci": r"\bpci\b|cardholder|credit.?card|payment card|\bpan\b|card number|"
+           r"card data",
+    "phi": r"\bphi\b|hipaa|patient|health record|\behr\b|\bemr\b|medical record",
+    "cui": r"\bcui\b|controlled unclassified|\bitar\b|export control|\bfouo\b|dfars|"
+           r"\bcmmc\b",
+    "spii": r"\bspii\b|social security|\bssn\b|passport|driver.?s?.? ?licen|biometric|"
+            r"bank account|routing number|\btax id\b",
+    "pii": r"\bpii\b|personal data|personally identifiable|mailing address|"
+           r"\baddress(es)?\b|date of birth|\bdob\b|phone number|email address",
+    "customer": r"customer|client\b|subscriber|account holder|\bmember\b|consumer|"
+                r"\bcrm\b",
+    "credentials": r"credential|password|\bsecret(s)?\b|api.?key|private key|token",
+}
+_COMPILED = {cls: re.compile(pat, re.I) for cls, pat in _KEYWORDS.items()}
+
+
+def classify(text: str) -> set:
+    """The data classes a blob of text points to.  A keyword read, nothing more."""
+    t = str(text or "")
+    return {cls for cls, pat in _COMPILED.items() if pat.search(t)}
+
+
+def rank(classes) -> list:
+    """The classes present, most serious first."""
+    present = set(classes or [])
+    return [c for c in ORDER if c in present]
+
+
+def impact_bump(classes) -> tuple:
+    """How much these classes raise the impact of a breach, and why.
+
+    The bump is the single most serious class, not a sum, so a known class lifts
+    the impact once; it does not stack an app up to the ceiling on its own."""
+    ranked = rank(classes)
+    if not ranked:
+        return 0, ""
+    bump = max(CLASSES[c]["bump"] for c in ranked)
+    labels = ", ".join(CLASSES[c]["label"] for c in ranked)
+    return bump, f"the application holds {labels}"
+
+
+def consequence(classes) -> str:
+    """One plain statement of what a breach of this data would mean."""
+    ranked = rank(classes)
+    if not ranked:
+        return ""
+    out = CLASSES[ranked[0]]["consequence"]
+    extra = [CLASSES[c]["label"] for c in ranked[1:]]
+    if extra:
+        out += " The application also appears to hold " + ", ".join(extra) + "."
+    return out
+
+
+def labels(classes) -> list:
+    """Human labels for the classes, most serious first."""
+    return [CLASSES[c]["label"] for c in rank(classes)]
+
+
+def _linked_repos(db, asset):
+    from app.core.models import ExternalAssetRepo, Repository
+
+    return (db.query(Repository)
+            .join(ExternalAssetRepo, ExternalAssetRepo.repository_id == Repository.id)
+            .filter(ExternalAssetRepo.asset_id == asset.id).all())
+
+
+def profile_for_asset(db, asset) -> dict:
+    """Derive the data profile of a DAST asset from the code linked to it.
+
+    -> {classes: [...], labels: [...], consequence: "...", bump: int,
+        basis: "...", from_repos: [...]}.  Empty classes when the linked
+    repositories carry nothing that places them in a class, so nothing is
+    invented: a profile only appears when a tag, an application name or a
+    repository name actually says so.
+    """
+    classes, from_repos = set(), []
+    for r in _linked_repos(db, asset):
+        text = " ".join([r.sensitivity or "", r.application_name or "", r.name or ""])
+        found = classify(text)
+        if found:
+            classes |= found
+            from_repos.append(r.full_name)
+    ranked = rank(classes)
+    bump, why = impact_bump(ranked)
+    basis = ""
+    if ranked:
+        basis = ("From the code behind this site: " + ", ".join(labels(ranked))
+                 + (f" (seen in {', '.join(from_repos[:6])}"
+                    + (" and more" if len(from_repos) > 6 else "") + ")"
+                    if from_repos else "") + ".")
+    return {"classes": ranked, "labels": labels(ranked),
+            "consequence": consequence(ranked), "bump": bump,
+            "basis": basis, "from_repos": from_repos}
@@ -3753,7 +3753,11 @@ def recover() -> int:
 
 2) Write "why" as a short risk narrative for an engineer, three to five \
 sentences, in this order:
- - what can go wrong: what an attacker gains if the finding is real;
+ - what can go wrong: what an attacker gains if the finding is real, and, when \
+the finding would expose the data the app holds, what that breach means in real \
+terms using ONLY the consequence provided in data_the_app_holds (for example SOX \
+fines, breach notification, customer and reputational loss); name no consequence \
+that was not provided;
  - how an abuser attacks it: the concrete steps against THIS finding, at this url;
  - how likely it is to lead to a breach: reason from the site's exposure (open \
 to the world raises it, allow listed lowers it), the attack surface and \
@@ -3921,14 +3925,18 @@ def triage(scan_id: int, actor: str = "") -> None:
         host = asset.host
         exposure = (getattr(asset, "exposure", "") or "")
         exposure_detail = (getattr(asset, "exposure_detail", "") or "")
+        from app.core import data_classification
+
+        data_profile = data_classification.profile_for_asset(db, asset)
         cap = max(1, int(settings_mod.get(db, "dast.ai_max_findings") or 40))
         prior = _prior_verdicts(db, scan.asset_id, scan_id)
-    # Deterministic risk (likelihood x breachability, weighted by exposure) and
-    # the verified real world precedent for each weakness class, computed before
-    # the model is asked, so it reasons from these facts rather than its memory.
+    # Deterministic risk (likelihood x breachability, weighted by exposure and by
+    # the data the app holds) and the verified real world precedent for each
+    # weakness class, computed before the model is asked, so it reasons from
+    # these facts rather than its memory.
     from app.core import dast_precedent, dast_risk
 
-    dast_risk.annotate(all_findings, exposure)
+    dast_risk.annotate(all_findings, exposure, data_profile["classes"])
     dast_precedent.annotate(all_findings)
     # Reuse a verdict for any finding unchanged since the last reviewed scan.
     reused = 0
@@ -3961,6 +3969,11 @@ def triage(scan_id: int, actor: str = "") -> None:
                             "unknown means the exposure check did not run"),
                 "detail": _clean(exposure_detail)[:200],
             },
+            "data_the_app_holds": {
+                "classes": data_profile["labels"],
+                "consequence_if_breached": data_profile["consequence"],
+                "source": "derived from the code repositories linked to this site",
+            },
             "dast_findings": [{"id": f.get("id") or f["key"], "tool": f.get("tool"),
                                "severity": f.get("severity"), "title": _clean(f.get("title")),
                                "url": _clean(f.get("url"))[:300],
 
@@ -1285,9 +1285,10 @@ def scan_page(asset_id: int, scan_id: int, request: Request, sev: str = "",
         findings = view["findings"]
         # Verified real world precedent per weakness class, from the vetted table,
         # so a finding shows its factual comparable case even before AI triage.
-        from app.core import dast_precedent
+        from app.core import data_classification, dast_precedent
 
         dast_precedent.annotate(findings)
+        data_profile = data_classification.profile_for_asset(db, asset)
         removed = external.removed_of(scan)
         if isinstance(view["ai"].get("summary"), dict):
             view["ai"]["summary"] = external.scrub_dast_review(view["ai"]["summary"], findings,
@@ -1307,6 +1308,7 @@ def scan_page(asset_id: int, scan_id: int, request: Request, sev: str = "",
         scope = (_dast_paths.scoping(_dast_paths.load(scan.paths).get("paths") or [])
                  if scan.paths_count is not None else None)
         context.update(active_page="external", asset=asset, scan=scan, view=view,
+                       data_profile=data_profile,
                        scope=scope, blocked_text=_dast_paths.blocked_text(scope or {}),
                        code=external.code_behind(db, user, scan, asset),
                        findings=findings, sev=sev, verdict=verdict, decided=decided,
 
@@ -140,6 +140,12 @@ <h2 class="new-page" style="margin-top:0">1.  Document control</h2>
 
 <h2>2.  Executive summary</h2>
 {% for paragraph in narrative %}<p>{{ paragraph | sentence_spaced }}</p>{% endfor %}
+{% if data_profile and data_profile.classes %}
+<p><strong>What this application holds.</strong>  From the code behind this site it handles
+  {{ data_profile.labels | join(', ') }}.  {{ data_profile.consequence | sentence_spaced }}
+  The findings below weigh this in: a weakness that reaches this data is a larger breach than
+  the same weakness on a site that holds none.</p>
+{% endif %}
 {% if ai_summary and (ai_summary.summary or ai_summary.withheld or ai_summary.withheld_dast) %}
 <h3>2.1  What the enhanced review found</h3>
 {% if ai_summary.summary %}<p>{{ ai_summary.summary | sentence_spaced }}</p>
 
@@ -48,6 +48,11 @@
 {% endif %}
 </div>
 
+{% if data_profile and data_profile.classes %}
+<div class="notice info"><div><strong>Data this app likely holds:</strong>
+  {% for lbl in data_profile.labels %}<span class="badge pending">{{ lbl }}</span> {% endfor %}
+  <span class="faint small">{{ data_profile.basis }}  This raises the impact of a breach here.</span></div></div>
+{% endif %}
 <div class="stats" data-live="scan-stats">
   <div class="stat {{ 'bad' if view.severity in ('critical','high') else ('ok' if scan.status == 'done' and view.severity in ('', 'none') else '') }}"><div class="n" style="{{ 'font-size:1.1rem' if view.severity in ('', 'none') }}">{% if scan.status != 'done' %}&ndash;{% elif view.severity in ('', 'none') %}no findings{% else %}{{ view.severity }}{% endif %}</div><div class="l">Worst found</div></div>
   {% for level in ['critical','high','medium','low','info'] %}