Skip to main content
Snapsec distinguishes between a Finding (an observation made during a specific scan or assessment) and a Vulnerability (a validated, persistent security defect attached to an asset).

​
Finding Lifecycle States

​
State Definitions

  • Active: Newly detected issue confirmed open and requiring remediation.
  • In Progress: Acknowledged by the technical owner; actively tracked in Jira/ticketing.
  • Risk Accepted: Valid finding where the business approves temporary exception.
  • Suppressed / False Positive: Excluded based on custom regex or rule suppression.
  • Resolved: Developer marked as fixed; pending verification.
  • Closed (Verified): Successfully re-tested by scanner or AI pentest with verified proof of fix.

​
Finding Anatomy

Each finding record contains:
  • Canonical Definition: Title, CVE ID, CWE classification, CVSS v3.1 vector.
  • Contextual TrueRisk™ Score: Computed organization-specific risk.
  • Proof-of-Concept Evidence: Verifiable HTTP request/response, injected commands, or logs.
  • Remediation Advisory: Exact code diff, framework-specific guidance, or config patch.
  • SLA Countdown: Days remaining before breach violation.