docs: expand proactive SCA section — Trivy prerequisite and setup paths (#2690)

* docs: expand proactive SCA section — Trivy prerequisite, setup paths, and deep-link anchor

Replaces the single-line Trivy note with a full explanation of how
proactive SCA nightly scans work, what's required (Trivy tool + vulnerability
patterns), both setup paths (coding standard / per-repo), and the silent
failure case when only the tool is enabled.

Adds a new H4 subsection with anchor #proactive-sca-requirements so Phase 2
CTAs (Dependency Explorer empty state OD-143, partial coverage banner OD-144)
can deep-link directly to the prerequisite content.

Closes OD-139

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: remove redundant admonition — requirements list is self-evident

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: rework SCA intro, remove inaccurate last sentence, add Dependencies cross-link

- Lead with what SCA findings are (dependency vulnerabilities) before
  explaining the daily re-scan feature
- Use "daily re-scans" (matches pricing page "Daily SCA and Malicious
  Package re-scans") and drop "nightly" / "every evening" inconsistency
- Remove inaccurate closing sentence — nightly scans always run for
  SCA-enabled orgs; enabling Trivy makes them produce results, not start
- Add cross-reference in the Dependencies section pointing to
  #proactive-sca-requirements so there's a path in both directions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: fix Business tier → business-tier (hyphen, consistent with rest of file)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: fold upgrade CTA inline, expand pattern list to sub-bullets

Removes the orange Important admonition that was breaking the reading
flow. The business-tier note is now a single inline sentence at the end
of the daily re-scans paragraph. Pattern IDs moved to sub-bullets for
readability.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: move Trivy requirements to Dependencies section, collapse SCA findings subsection

SCA findings behave identically to other git findings — no separate
lifecycle documentation needed. The unique part (daily re-scans + Trivy
requirements) belongs with Dependencies, where an admin with an empty
tab will look for help.

- SCA findings subsection: collapsed to 2 sentences + link to
  #proactive-sca-requirements
- Trivy requirements block: moved from H4 under Findings to H3 under
  Dependencies, anchor preserved for Phase 2 CTA deep-links (OD-143,
  OD-144)
- Dependencies upgrade CTA: updated to use Knock link for consistency

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: move page access instruction before requirements subsection

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Revert "docs: move page access instruction before requirements subsection"

This reverts commit d5d6ad1.

* docs: add 'Viewing your dependencies' heading before access sentence

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: claudiacodacy

docs/organizations/managing-security-and-risk.md

@@ -189,15 +189,9 @@ Codacy closes a finding in either of the following cases:
 
 ### How Codacy manages findings detected during software composition analysis (SCA) {: id="opening-and-closing-sca-items"}
 
-!!! note
-    To make sure that Codacy detects dependency issues correctly, [enable code patterns](../repositories-configure/configuring-code-patterns.md) belonging to the Trivy tool. 
-
-Vulnerable dependencies are a specific GIT repository finding. Similarly to other repository findings, Codacy opens an issue whenever a commit is analyzed.
+SCA findings behave like other Git repository findings. Codacy opens a finding whenever a commit to the default branch is analyzed and a vulnerable dependency is detected, and closes it when the dependency is no longer detected.
 
-Additionally, Codacy scans your codebase every evening to see if it's affected by any newly discovered vulnerabilities.
-
-!!! important
-    The proactive SCA scanning is a business tier feature. If you are a Codacy Pro customer interested in upgrading to gain access to this feature, reach out to our customer success team.
+On the Business plan, Codacy also runs [daily re-scans](#proactive-sca-requirements) across all repositories — so newly discovered vulnerabilities are surfaced even without a new commit. [Talk to us](https://start-chat.com/slack/codacy/rmbTzb) if you're interested in upgrading.
 
 
 ### How Codacy manages findings detected on Jira {: id="opening-and-closing-jira-items"}
@@ -569,10 +563,28 @@ Security and risk management supports checking the languages and infrastructure-
 ## Dependencies {: id="dependencies-list"}
 
 !!! important
-    The dependency tab is a business-tier feature. If you are a Codacy Pro customer interested in upgrading to gain access to this feature, contact our customer success team.
+    The dependency tab is a business-tier feature. If you are a Codacy Pro customer interested in upgrading to gain access to this feature, [talk to us](https://start-chat.com/slack/codacy/rmbTzb).
+
+The **Security and risk management Dependencies** page displays a unified view of all dependencies used by your repositories, populated by Codacy's daily SCA re-scans.
+
+### Daily re-scan requirements {: id="proactive-sca-requirements"}
+
+Proactive SCA uses **Trivy** as its scanning tool. For daily re-scans to produce results on a repository, **both** conditions must be met:
+
+1. The **Trivy tool** is enabled — either through a [coding standard](using-coding-standards.md) applied to the repository, or directly via the repository's [Code patterns settings](../repositories-configure/configuring-code-patterns.md).
+2. At least one **Trivy vulnerability pattern** is enabled:
+    -   `Trivy_vulnerability_critical`
+    -   `Trivy_vulnerability_high`
+    -   `Trivy_vulnerability_medium`
+    -   `Trivy_vulnerability_minor`
+    -   `Trivy_malicious_packages`
+
+To enable Trivy across your organization, you can:
 
+-   **Recommended — via coding standard:** [Add Trivy to a coding standard](using-coding-standards.md), enable its vulnerability patterns in the standard configuration, and apply the standard to your repositories. This covers all linked repositories in one step.
+-   **Per repository:** Open each repository's [Code patterns page](../repositories-configure/configuring-code-patterns.md), enable the Trivy tool, and enable the relevant vulnerability patterns.
 
-The **Security and risk management Dependencies** page displays a unified view of all dependencies used by your repositories. 
+### Viewing your dependencies
 
 To access the dependencies page, access the [overview page](#dashboard) and click the **Dependencies** tab.