Findings tracking
Findings tracking is where a review’s output becomes work. Each review — a penetration test, an internal audit, a regulator’s inspection, a red-team exercise — gets a follow-up, and inside it sit the individual findings: one row per non-conformity, observation or recommendation, each with a severity, an owner, a due date and a status that moves until the issue is closed.
Where to find it
Section titled “Where to find it”Governance → Findings tracking in the sidebar. Individual records are labelled Follow-up in the interface.
Key concepts
Section titled “Key concepts”The follow-up
Section titled “The follow-up”A follow-up is an assessment, in the same family as audits and risk assessments: it lives in a Domain, optionally narrows to a Perimeter, and carries Authors, Reviewers, a Version, a Status (planned, in progress, in review, done, deprecated) and an ETA. On top of that it records:
- Category — Pentest, Threat hunting, Red teaming, Audit, Self-identified, Posture follow-up or Responsible disclosure. This is what lets a dashboard separate what the pentester found from what the auditor found.
- Reference ID — the assessor’s own identifier for the engagement.
- Reported at — when the review reported its results.
- Evidences — the report itself, the scope letter, the rules of engagement.
- Observation — free-text notes on the engagement.
Setting a follow-up to Locked freezes it: its findings can no longer be modified. That is how a signed-off pentest report stays the record of what was actually found.
The finding
Section titled “The finding”Each finding carries a Reference ID and Name, a Description of the issue, an Observation capturing what was seen, a Severity on the shared scale (undefined, info, low, medium, high, critical), an optional Priority from P1 to P4, one or more Owners, and an ETA and Due date.
Its Status is the closure signal:
| Status | Meaning |
|---|---|
| Undefined | Not yet triaged |
| Identified | Raised, not yet confirmed |
| Confirmed | Verified as real |
| Dismissed | Examined and rejected — a false positive or out of scope |
| Assigned | Handed to an owner |
| In progress | Remediation under way |
| Mitigated | Risk reduced, root cause still present |
| Resolved | Fixed |
| Closed | Fixed and verified |
| Deprecated | No longer relevant |
Follow-up action plan
Section titled “Follow-up action plan”A finding points at everything it concerns: the Asset affected, the Requirement it was raised against, the Threats it realises, the Vulnerabilities it exploits, suggested Reference controls, and the Applied controls that remediate it. The control link is many-to-many, so one control can close several findings and one finding can need several controls.
That link is what turns the list into a plan. A follow-up’s Action plan view collects every applied control remediating its findings, with status, owner and ETA, so the remediation programme is visible in one place rather than scattered across the register.
Working with follow-ups
Section titled “Working with follow-ups”Create a follow-up first, then add findings to it — the finding form asks which follow-up it belongs to. For a bulk import from a pentest spreadsheet, use the data import wizard’s findings tracker importer instead of entering rows by hand.
The detail page shows a Summary of the engagement — findings by severity, findings by status, Progress, and an Unresolved High or Critical counter, the number that usually drives the conversation. Export produces the follow-up as PDF, Excel or Markdown.
Related
Section titled “Related”- Applied controls — what actually closes a finding.
- Vulnerabilities — technical weaknesses tracked in their own register.
- Audits — the source of audit-category findings.
- Evidences — attach the report the findings came from.