Findings lifecycle
A finding is a single posture issue Retrievy detected in your environment. It has a severity badge (Critical, High, Medium, Low, or Informational), a source module (CSPM, ISPM, SCM), and a status that tells you where the finding is in its remediation life.
This page describes those statuses and the rules that govern how a finding moves between them. The board where you actually act on these transitions is the Hardening Kanban.
This page is a concept. To see findings in action, open the Hardening Kanban.
The six statuses
Each finding carries one of these as an inline status badge:
| Badge | What it means | Kanban column |
|---|---|---|
| Open | New finding from the most recent scan. Active risk, counts toward your Retrievy Index. | Triage Required |
| Reopened | Finding was previously resolved but came back on a later scan. Treated identically to Open for scoring; tagged separately so the team knows it regressed. | Triage Required |
| Pending Verification | You clicked Resolve Finding in the drawer. Retrievy is waiting for the next scan to confirm the fix. Excluded from the score until verified. | Verifying Remediation |
| Resolved (Verified) | The next scan didn't find this issue. Terminal state. Read-only. | Hardened / Resolved |
| Resolved (Automated) | Retrievy detected the issue was fixed without human input (e.g., the resource was deleted, or a cloud-side auto-remediation kicked in). Terminal state, scanner-verified. | Hardened / Resolved |
| Risk Accepted | A workspace admin formally accepted the risk via an entry in the Security Exceptions register. Excluded from the score for the duration of the exception. | Accepted Exceptions |
How findings start out
When a scan runs, Retrievy ingests every issue it detected and compares against the prior scan:
- A new issue that wasn't in the previous scan → status Open.
- An issue that was in the previous scan and is still present → status stays whatever it was (Open, Pending Verification, etc.).
- An issue that was previously Resolved but is back → status Reopened with a regression marker (the
↩indicator on the card). - An issue that was previously present and is now gone → status flips to Resolved (Automated).
The system doesn't ask before promoting a finding to Resolved (Automated). If a scan doesn't find it, it's gone.
Transitions you can drive
Three explicit actions move a finding between statuses. They live in the finding's drawer (open by clicking the card on the Kanban).
Resolve Finding
Available when the badge is Open or Reopened.
Click Resolve Finding when you've fixed the issue and want Retrievy to confirm with the next scan. The first click changes the button to Click again to confirm for three seconds, an intentional speed bump. Click again within the window to commit.
Status flips to Pending Verification. The finding moves to the Kanban Verifying Remediation column. It stops counting toward your Retrievy Index immediately.
Accept Risk
Available when the badge is Open or Reopened.
Click Accept Risk to formally record this risk as known and out-of-scope for remediation. The Security Exception modal opens; pick a classification, scope, duration, and write a justification (minimum 10 characters). See Security Exceptions for the full flow.
Status flips to Risk Accepted. The finding moves to the Kanban Accepted Exceptions column. It stops counting toward your Retrievy Index for the duration of the exception.
Drag-and-drop
You can drag a card from Triage Required to Verifying Remediation on the board view. That's equivalent to clicking Resolve Finding in the drawer.
You cannot drag into Hardened / Resolved or Accepted Exceptions. Those columns are write-locked because they require scanner verification (for resolution) or the formal Accept Risk flow (for exceptions).
Transitions that happen automatically
Two automatic transitions don't need a click.
Pending Verification → Resolved (Verified)
When the next scan ingests and the issue is no longer detected, the finding flips from Pending Verification to Resolved (Verified). It moves to the Hardened / Resolved column. Terminal state.
If the next scan still finds the issue, the status flips back to Open (with the Reopened label if applicable) and reappears in the Triage Required column.
Risk Accepted → Open (on expiry)
When a Risk Accepted finding's exception expires (the date set during the Accept Risk flow), the finding automatically returns to Open and reappears in the Triage Required column. The exception record stays in the Security Exceptions registry as audit history.
Seven days before expiry, the approver gets an email warning so they can extend or remediate before the finding re-enters scoring.
What each transition does to your Retrievy Index
| Transition | Effect on the score |
|---|---|
| Scan ingests a new Open finding | Increases your weighted failure count by the finding's severity weight. Score drops. |
| Open → Pending Verification (Resolve Finding) | Decreases your weighted failure count by the finding's severity weight. Score rises immediately. |
| Pending Verification → Resolved (Verified) | No effect. The finding was already excluded from the score; verification just records it as truly fixed. |
| Open → Risk Accepted (Accept Risk) | Decreases your weighted failure count by the finding's severity weight. Score rises immediately. |
| Risk Accepted → Open (expiry) | Increases your weighted failure count by the severity weight. Score drops. |
| Any → Resolved (Automated) (scanner detects the issue is gone) | Decreases the weighted failure count if the finding was Open or Reopened. No effect if it was already excluded. |
All recomputes happen within seconds of the transition. The math is in How the Retrievy Index is calculated.
Forbidden transitions
For completeness, a finding cannot:
- Go directly from Open to Resolved. It must pass through Pending Verification so the scanner confirms.
- Move out of Hardened / Resolved by hand. A new scan that re-detects the issue is the only way to bring it back (as Reopened).
- Move out of Accepted Exceptions by hand. Either the exception expires automatically or an admin revokes the exception via the Security Exceptions registry, which returns the finding to Open.