Steve and I are looking into how WhiteSource does its categorization. 

Before presenting to the security team, we need to see which structure is best.