Findings Management

Filter	Description
Status	Whether a finding is open or closed
In Project	The engagement the finding belongs to, such as External Pentest, Internal Pentest, or Web Application Testing
State is	The current remediation status of the finding. Options include Pending Fix, In Progress, Retest Ready, Risk Accepted, and Fixed
Severity	The criticality level assigned by the tester. Options include Critical, High, Medium, Low, and Informational
Tag	Framework classifications including MITRE ATT&CK, OWASP and PCI
Assigned To	The organization member responsible for remediating the finding
Time Period	Filters findings by the date they were published to you
Asset Custom Tag	Filters by custom tags applied to associated assets

Sort

Click a column header to sort by Severity, Published, or Last Updated. [3]

Export

To export a list of findings, click the Download icon button, then select your preferred file type from the menu. [1]

Export List of Findings_Annotated_box.png

Note: Finding age is measured from the date the finding was published to you, including in exports and the Public API.

</aside>

Severity Levels

Every finding is assigned a severity level by your Sprocket testing team. Severity reflects the criticality of the vulnerability and the likelihood of successful exploitation.

Critical

Description: Requires immediate remediation. Represents the highest level of risk to the organization.
Impact: Exploitation results in full compromise of the target, unauthorized access to sensitive data, or complete loss of confidentiality, integrity, or availability. Can enable further compromise of connected systems or resources.
Attack Characteristics: Exploitable without authentication or special privileges, and requires no interaction from another party. May have publicly available exploits or evidence of active exploitation.
Exploitation Likelihood: High

High

Description: Should be prioritized for remediation in the near term.
Impact: Exploitation results in significant unauthorized access, data exposure, or disruption of service. Can be chained with lower-severity findings to escalate to critical-level impact.
Attack Characteristics: Exploitable but may require some level of authenticated access, a specific configuration state, or interaction from another party to trigger.
Exploitation Likelihood: High

Medium

Description: Should be addressed in a reasonable timeframe but does not require immediate action.
Impact: Limited direct impact in isolation, but frequently chainable with other vulnerabilities to significantly elevate risk. May expose sensitive information or enable partial unauthorized access.
Attack Characteristics: Exploitation typically requires multiple preconditions, elevated privileges, or actions from another party that are not guaranteed.
Exploitation Likelihood: Medium

Low

Description: **Remediation can be scheduled and prioritized against other business needs.
Impact: Minimal standalone impact. Unlikely to be exploited in isolation, though may contribute to an attack chain in a highly targeted scenario.
Attack Characteristics: Exploitation requires significant preconditions or a low-probability sequence of events to succeed.
Exploitation Likelihood: Low

Informational

Managing Remediation

Your team can update the State of a finding to communicate remediation progress. The available options depend on the current State of the finding. You can move a finding from Pending Fix to In Progress, then to Retest Ready once you believe the vulnerability has been addressed. You can also move a finding backward at any point.

</aside>

| --- | --- |

</aside>

Updating State

State can be updated in two ways, standalone or alongside a comment.

Validating Fixes

Once a finding is marked Retest Ready, your Sprocket testing team is automatically notified and will begin retesting. No further action is required from your team.

</aside>

Table of Contents

Quick Links

Location

Severity Levels

Managing Remediation

Updating State

Validating Fixes

Commenting and Collaboration

Integrations to Support Remediation

Sprocket Platform Public API