@@ -13,6 +13,10 @@ DefectDojo uses five main data classes to organize your work: **Organizations, A
 
 DefectDojo is made to be flexible to conform to your team, rather than making your team conform to the tool. You'll be able to design a robust, adaptable workspace once you understand how these data classes can be used to organize your work.
 
+An Organization groups related Assets, for example by business domain or by team. An Asset is a project, program or application that you are testing, and it holds all of the testing history for it. An Engagement is a testing effort on an Asset, either Interactive or CI/CD, and contains one or more Tests. A Test holds the results of one testing activity, such as an imported scan, and each flaw it reports is a Finding.
+
+Access control is applied to Organizations and Assets, not to Engagements, and deduplication only applies within a single Asset. When you plan your structure, start with [What can an Organization represent?](#what-can-an-organization-represent) and [What can an Asset represent?](#what-can-an-asset-represent), then read [What can an Engagement represent?](#what-can-an-engagement-represent) for examples of grouping Tests.
+
 ### Asset Hierarchy Diagram
 ![image](images/Asset_Hierarchy_Full.png)
 
 
@@ -9,6 +9,8 @@ aliases:
 ---
 Organizations → **ASSETS** → Engagements → Tests → Findings
 
+An Asset is the thing whose security posture you want to track over time, such as an application, an API or a cloud environment. It holds every Engagement, Test and Finding for that thing, and its settings decide the SLA, permissions and deduplication scope those Findings use. To decide how broad each Asset should be, read [Asset Examples](#asset-examples) and [Asset Boundaries](#asset-boundaries). To add an Asset, see [Create Assets](#create-assets).
+
 ## Overview
 
 **Assets** sit at the center of how security work is organized within DefectDojo’s object hierarchy. Assets represent any project, program, software, or physical asset that your security team is testing, and host all of the security work and testing history related to the testing goal. Examples of Assets can include:
@@ -37,6 +39,50 @@ Assets can become even more granular depending on the needs of your organization
 
 While you may also elect to represent these variations as Engagements within a single Asset, access can only be granted at the level of Assets or Organizations, which may limit users’ access to the appropriate Engagement (as well as the Tests and Findings within those Engagements) if they’re organized as such. For more information, see [Open-Source Permissions](/admin/user_management/os__authorized_users/).
 
+## Asset Boundaries 
+
+### Deduplication 
+
+Assets are “walled-off” and do not interact with other Assets. DefectDojo’s Smart Features, such as Deduplication, only apply within the context of a single Asset. Findings across different Assets will not be automatically deduplicated.
+
+### Metrics 
+
+Most reporting and metrics aggregate data at the Asset level, making Assets the primary unit for measuring and tracking risk.
+
+As a result, many key metrics are calculated per Asset, including:
+
+- Total number of Findings (by severity or status)
+- Mean time to remediate (MTTR)
+- SLA compliance and breach rates
+- Risk trends over time
+
+This means that how Assets are structured will directly impact the accuracy and usefulness of reports. For example, grouping multiple unrelated systems under a single Asset may obscure risk visibility, while overly granular Asset structures can fragment reporting, making it difficult to identify broader trends.
+
+Asset-specific metrics can be accessed from the **Metrics** button in the top bar of the chosen Asset’s view. 
+
+![image](images/asset_ss8.png)
+
+### CI/CD Pipeline
+
+CI/CD pipelines automate the import of scan results. Regardless of the integration method, all scan imports must be associated with an Asset, making the Asset the anchor point for pipeline-driven security data.
+
+When a pipeline submits scan results, it must either:
+
+- Specify an existing Asset (and optionally an Engagement), or
+- Be configured in a way that consistently maps results to the correct Asset
+
+All imported Findings will inherit the Asset’s context, including ownership, permissions, SLA configuration, and reporting scope.
+
+In practice, Assets should be defined to reflect how systems are built and deployed within CI/CD to ensure that security results are consistently associated with the correct application or service.
+
+### Jira Relationships 
+
+Assets can be mapped directly to Jira Projects, which push the Asset’s Findings into a Jira instance.
+
+Because Findings inherit risk, priority, and ownership from their parent Asset, the Asset effectively determines the remediation context that flows into Jira tickets and Downstream Connector workflows.
+
+Importantly, Assets are also the primary determining factor in a Finding’s SLA characteristics. Therefore, the SLA of a Finding depends on the SLA configuration of its parent Asset. More information about SLA configurations can be found [here](/asset_modelling/os_hierarchy/os__sla_configuration/#main-content). 
+
 ## Asset Data 
 
 Assets will always include the following components:
@@ -134,47 +180,3 @@ Deleting an Asset will also delete the following:
 - All associated security history, including Findings and integrations
 - Any linked Jira Epics
 - All notes and file uploads associated with the Asset’s Engagements and Tests
-
-## Asset Boundaries 
-
-### Deduplication 
-
-Assets are “walled-off” and do not interact with other Assets. DefectDojo’s Smart Features, such as Deduplication, only apply within the context of a single Asset. Findings across different Assets will not be automatically deduplicated.
-
-### Metrics 
-
-Most reporting and metrics aggregate data at the Asset level, making Assets the primary unit for measuring and tracking risk.
-
-As a result, many key metrics are calculated per Asset, including:
-
-- Total number of Findings (by severity or status)
-- Mean time to remediate (MTTR)
-- SLA compliance and breach rates
-- Risk trends over time
-
-This means that how Assets are structured will directly impact the accuracy and usefulness of reports. For example, grouping multiple unrelated systems under a single Asset may obscure risk visibility, while overly granular Asset structures can fragment reporting, making it difficult to identify broader trends.
-
-Asset-specific metrics can be accessed from the **Metrics** button in the top bar of the chosen Asset’s view. 
-
-![image](images/asset_ss8.png)
-
-### CI/CD Pipeline
-
-CI/CD pipelines automate the import of scan results. Regardless of the integration method, all scan imports must be associated with an Asset, making the Asset the anchor point for pipeline-driven security data.
-
-When a pipeline submits scan results, it must either:
-
-- Specify an existing Asset (and optionally an Engagement), or
-- Be configured in a way that consistently maps results to the correct Asset
-
-All imported Findings will inherit the Asset’s context, including ownership, permissions, SLA configuration, and reporting scope.
-
-In practice, Assets should be defined to reflect how systems are built and deployed within CI/CD to ensure that security results are consistently associated with the correct application or service.
-
-### Jira Relationships 
-
-Assets can be mapped directly to Jira Projects, which push the Asset’s Findings into a Jira instance.
-
-Because Findings inherit risk, priority, and ownership from their parent Asset, the Asset effectively determines the remediation context that flows into Jira tickets and Downstream Connector workflows.
-
-Importantly, Assets are also the primary determining factor in a Finding’s SLA characteristics. Therefore, the SLA of a Finding depends on the SLA configuration of its parent Asset. More information about SLA configurations can be found [here](/asset_modelling/os_hierarchy/os__sla_configuration/#main-content). 
 
@@ -22,6 +22,8 @@ aliases:
 
 <span style="background-color:rgba(242, 86, 29, 0.3)">DefectDojo, Inc. and open-source contributors maintain this documentation to support both the Community and Pro editions of DefectDojo.</span>
 
+To try DefectDojo without installing anything, log in to one of the [Online Demos](#online-demos). To install the Open-Source edition, start with the [Installation](/get_started/open_source/installation/) guide, and for Pro, see [Self-Hosting DefectDojo Pro](/get_started/pro/onprem/installation_options/). The [Feature comparison](/get_started/about/defectdojo_versions/) lists what each edition includes.
+
 ## What is DefectDojo?
 
 DefectDojo is a Developer Security Operations (DevSecOps) platform. DefectDojo streamlines DevSecOps by serving as an automatic aggregator for your suite of security tools, allowing you to easily organize your security work and report your organization’s security posture to other stakeholders.
@@ -44,6 +46,24 @@ DefectDojo has smart features to enhance and tune the results from your security
 
 Ultimately, DefectDojo's Asset:Engagement model allows you to take inventory of your development environment and immediately place new security Findings in context.
 
+## Online Demos
+
+Online demos for both Open-Source and Pro versions of DefectDojo are available.  Both can be accessed using the following credentials:
+
+- Username: `admin`
+- Password: `1Defectdojo@demo#appsec`
+
+These demos come loaded with sample data, and are reset on a daily basis.
+
+### Open-Source Demo
+
+A running example of DefectDojo (Open-Source Edition) is available at [https://demo.defectdojo.org/](https://demo.defectdojo.org/).
+
+### Pro Demo
+
+A running example of DefectDojo Pro is available at
+[https://pro.demo.defectdojo.com/](https://pro.demo.defectdojo.com/).
+
 ---
 Here are some examples of ways DefectDojo can be implemented, with DefectDojo co-founder and CTO Matt Tesauro:
 <iframe width="560" height="315" src="https://www.youtube.com/embed/44vv-KspHBs?si=OwfGHs2VTQ886-FB" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>
@@ -94,24 +114,6 @@ The Pro edition is available as a cloud-hosted SaaS offering, and is also availa
 
 For more information on DefectDojo Pro, check out our [Pricing page](https://defectdojo.com/pricing).
 
-## Online Demos
-
-Online demos for both Open-Source and Pro versions of DefectDojo are available.  Both can be accessed using the following credentials:
-
-- Username: `admin`
-- Password: `1Defectdojo@demo#appsec`
-
-These demos come loaded with sample data, and are reset on a daily basis.
-
-### Open-Source Demo
-
-A running example of DefectDojo (Open-Source Edition) is available at [https://demo.defectdojo.org/](https://demo.defectdojo.org/).
-
-### Pro Demo
-
-A running example of DefectDojo Pro is available at
-[https://pro.demo.defectdojo.com/](https://pro.demo.defectdojo.com/).
-
 ## Learning DefectDojo
 
 Whether you’re a Pro or an Open-Source user, we have many resources to help you get started with DefectDojo.
 
@@ -18,6 +18,26 @@ aliases:
 Covers deployment on AWS EKS and OpenShift (ROSA). The workflow is the same
 for both: set up infrastructure, create secrets, install the chart.
 
+## Quick Path
+
+1. Gather the values in the [Pre-Install Checklist](#pre-install-checklist)
+   and install the tools listed under [Prerequisites](#prerequisites).
+2. [Extract the Chart Package](#extract-the-chart-package) and
+   [Prepare Your Values File](#prepare-your-values-file).
+3. [Generate Secrets](#generate-secrets) and
+   [Create Internal TLS Certificates](#create-internal-tls-certificates).
+4. Supply your [License](#license).
+5. [Validate the templates](#pre-flight-validate-templates), then
+   [Deploy](#deploy) and [Verify](#verify). To deploy through ArgoCD instead,
+   see [Deploy with ArgoCD](#deploy-with-argocd).
+
+To log in to the DefectDojo registry by hand with the key in your license, see
+[Inspecting Your License](#inspecting-your-license). If your cluster can't pull
+from the default DefectDojo registry, see
+[Private Registry / Air-Gapped Environments](#private-registry--air-gapped-environments).
+For problems after the install, see [Known Issues](#known-issues) and
+[Troubleshooting](#troubleshooting).
+
 ---
 
 ## Pre-Install Checklist
 
@@ -9,6 +9,8 @@ When a Test is created in DefectDojo (either in advance or by importing a scan f
 
 For example, let’s say you have a CI/CD pipeline, which is designed to send a new report to DefectDojo every day. Rather than create a new Test or Engagement for each ‘run’ of the pipeline, you could have each report flow into the same Test using **Reimport**.
 
+A Reimport creates Findings that are new in the report, leaves matching Findings in place, can close Findings that are missing from the report, and reopens closed Findings that come back. Each of these outcomes, and the settings that turn closing and reopening off, is described under [Reimport Logic](#reimport-logic-create-ignore-close-or-reopen). Whether an incoming item matches an existing Finding is decided by [Reimport Deduplication](#reimport-deduplication). To start a Reimport from the UI, see [Opening the Reimport form](#opening-the-reimport-form).
+
 ## Reimport: Process Summary
 
 Reimporting data does not replace any old data in the Test, instead, it compares the incoming scan file with the existing scan data in a test to make informed decisions:
@@ -81,6 +83,14 @@ If you want a Risk Accepted or Duplicate Finding to become Active again, you nee
 
 The **Scan Date** field on the Reimport form starts empty. Left empty, each Finding that the Reimport creates keeps the date from the report (or today's date if the report has none). If you select a Scan Date, it is applied to every Finding the Reimport creates. Findings that already exist in the Test keep their dates either way.
 
+## Reimport Deduplication
+
+Reimport decides whether an incoming item matches an existing Finding using **[Reimport Deduplication](/triage_findings/finding_deduplication/about_deduplication/)** settings. This is separate from “Same Tool Deduplication” and “Cross Tool Deduplication,” which operate after Findings exist. [How DefectDojo Deduplicates Findings Across Security Tools](/triage_findings/finding_deduplication/deduplication_across_tools/) explains how the two steps fit together.
+
+If you are seeing Reimport close old Findings and create new Findings when only a minor attribute changes (for example, a line number shift), tune **Reimport Deduplication** for that tool to use stable identifiers that ignore those attributes (such as Unique ID From Tool).
+
+**DefectDojo Pro** can solve this directly for tools without reliable unique IDs: enabling **[Location Drift Matching](/triage_findings/finding_deduplication/pro__location_drift_matching/)** makes Reimport recognize a Finding whose location moved (a line shift, file rename, URL move, or dependency version bump) as the *same* Finding, updating it in place and preserving its location history.
+
 ## Why Findings Close and Reopen
 
 A Finding that keeps closing and coming back is usually reimport doing exactly what it was asked to, on data that does not match what the user expects. The evidence is on two pages:
@@ -121,14 +131,6 @@ This header indicates the actions taken by an Import/Reimport.
 * **\# left untouched shows the count of Open Findings which were unchanged by a Reimport (because they also existed in the incoming report).**
 * **\#** **reactivated** shows any Closed Findings which were reopened by an incoming Reimport.
 
-## Reimport Deduplication
-
-Reimport decides whether an incoming item matches an existing Finding using **[Reimport Deduplication](/triage_findings/finding_deduplication/about_deduplication/)** settings. This is separate from “Same Tool Deduplication” and “Cross Tool Deduplication,” which operate after Findings exist. [How DefectDojo Deduplicates Findings Across Security Tools](/triage_findings/finding_deduplication/deduplication_across_tools/) explains how the two steps fit together.
-
-If you are seeing Reimport close old Findings and create new Findings when only a minor attribute changes (for example, a line number shift), tune **Reimport Deduplication** for that tool to use stable identifiers that ignore those attributes (such as Unique ID From Tool).
-
-**DefectDojo Pro** can solve this directly for tools without reliable unique IDs: enabling **[Location Drift Matching](/triage_findings/finding_deduplication/pro__location_drift_matching/)** makes Reimport recognize a Finding whose location moved — a line shift, file rename, URL move, or dependency version bump — as the *same* Finding, updating it in place and preserving its location history.
-
 ## Reimport via API - special note
 
 Note that the /reimport API endpoint can both **extend an existing Test** (apply the method in this article) **or create a new Test** with new data \- an initial call to `/import`, or setting up a Test in advance is not required.