Skip to main content
Findings are security vulnerabilities and issues discovered during scans. The findings list is where you review and triage all discovered issues across your assets.

​
Viewing findings

Each finding in the list displays:

​
Filtering and sorting

Use filters to focus on what matters:
  • By finding name: Search by vulnerability name, with partial matching supported
  • By risk level: View only Critical and High findings, exclude informational items
  • By status: Track remediation progress (Open, Fixed, Accepted, etc.)
  • By target: Scope to specific targets
  • By source: Filter by scanner type or manually added findings
  • By verified status: Show only verified or unverified findings
  • By scan date: Filter by when findings were discovered
  • By workspace: Scope findings to a specific workspace. Hidden by default; enable the column using the Show all owned workspaces toggle.
Start your triage by filtering for Critical and High severity findings.

​
Finding details

Select any finding to view full details:
  • Risk level: Current severity rating (Critical, High, Medium, Low, Info)
  • Status: Current triage status (Open, Fixed, Accepted, Ignored, False Positive)
  • Verified: Whether the finding has been manually confirmed
All three can be changed directly from the detail view. Each change optionally includes a reason, which is recorded and applied to duplicate findings in the same group.
  • Description: What the vulnerability is and why it’s a security concern
  • Evidence: Proof of the vulnerability (request/response data, screenshots, payloads)
  • How to reproduce: Steps to reproduce the vulnerability
  • Risk description: Explanation of the potential impact
  • Recommendation: Guidance on how to fix the issue
  • References: Links to CVE entries, CWE classifications, OWASP documentation
Additional metadata fields include Port, Protocol, Service, CVSS scores, CVE, CWE, EPSS score, CISA KEV status, and OWASP classifications.

​
Actions

​
Change status

Update the finding’s lifecycle status:
Document all risk acceptance decisions with clear rationale.

​
Change risk level

Adjust the severity rating if the automated assessment doesn’t match the actual risk in your environment. Consider factors like:
  • Business context and asset criticality
  • Compensating controls in place
  • Actual exploitability in your environment

​
How risk level is determined

Risk levels are pre-defined per vulnerability type. SQL injection is always Critical; a missing security header is typically Low or Info. The level is set once when the finding is created, not derived from CVSS. Two detection engines calculate risk from external scores instead: CVSS scores (v2 and v3) are stored on the finding as reference data when available. They are shown in the finding detail on the Findings page and returned by the API. They are not recalculated after a finding is created. The platform tracks two risk level values: the original scanner-assigned level and the current level (which you may have changed). To revert an override, select Reset from the risk level dropdown.

​
Add notes and comments

Document your findings with:
  • Validation details and reproduction steps
  • Remediation notes and progress updates
  • Team communication and handoff information

​
Rescan to verify fixes

1

Apply the fix

Implement the recommended remediation.
2

Rescan the target

Run a targeted scan to verify the fix worked.
3

Update status

Mark as Fixed if remediation is successful.

​
Bulk operations

Select multiple findings to apply changes in bulk. Available operations appear in the toolbar.
Status, risk level, and verified changes automatically propagate to duplicate findings in the same group.
Findings created by scans cannot be deleted from the findings list. To remove them, delete the scan that produced them.

​
Add manual findings

Manual findings are available on the Pentest Suite plan. View plans
Create findings manually for vulnerabilities discovered through manual testing that automated scanners can’t detect. Use finding templates to standardize documentation and save time.

​
Deduplication

When running multiple scans, the same vulnerability may be detected more than once. Findings are automatically grouped as duplicates when they match on:
  • Vulnerability type
  • Location (same asset and URL/endpoint)
  • Affected parameter
Deduplication groups findings but doesn’t delete them. You can always see the full history.

​
Reporting

Generate reports directly from selected findings in multiple formats (PDF, DOCX, HTML, XLSX, CSV, JSON).

Reporting

Learn how to generate reports, create templates, and export findings.