Findings and remediation
Finding states
Reference for finding workflow states.
- Audience
- All workspace members
- Plan availability
- All plans
- Last reviewed
Findings in Cyber Health Score have two related concepts: severity (how serious the issue is) and workflow status (where the finding is in your review and remediation process). This page describes the workflow states the product implements today.
Workflow status
| Status | Meaning |
|---|---|
| Open | A newly detected or outstanding finding that still needs review or remediation. |
| In progress | The finding is assigned or actively being worked on. |
| Resolved | The finding has been marked as fixed or no longer applicable in your workflow. |
| Accepted | The finding is consciously accepted as residual risk with documented governance. |
Analysts and above can update workflow status, assign findings, and set due dates. Viewers can review findings but cannot change workflow fields.
Severity (separate from workflow status)
Severity describes prioritisation, not whether a finding is closed:
| Severity | Typical use |
|---|---|
| Info | Informational signal with lower immediate priority |
| Low | Minor issue; address when capacity allows |
| Medium | Moderate issue; plan remediation |
| High | Important issue; prioritise for exposed services |
| Critical | Highest priority in the product's severity scale |
Severity helps you triage when time is limited. It is guidance, not a guarantee of business impact. See Understanding finding severities for more detail.
Verification after a rescan
When a finding is checked against a later scan, the product may show a verification label such as:
| Label | Meaning |
|---|---|
| No verification scan requested yet | No follow-up verification scan has been requested for this finding. |
| Verification pending | A verification scan is queued or in progress. |
| CHS verified this fix | The latest scan did not detect the issue that was previously reported. |
| Still detected in latest scan | The issue is still present after remediation or a rescan. |
Verification labels describe scan evidence. They are separate from workflow status, although teams often mark a finding Resolved after verification confirms the fix.
What happens after a rescan
When a new scan completes, findings are reconciled with earlier records:
- Accepted findings stay Accepted until you change them manually.
- In progress findings stay In progress until you update them.
- Resolved findings return to Open if the same issue is detected again; otherwise they stay Resolved.
There is no separate workflow status for findings that return after resolution. A finding that appears again is shown as Open.
Related documentation
Related documentation
Return to the documentation home to browse all topics.
Back to documentation