Vulnerability states and definitions

We’ve renamed Finding state to Vulnerability state. This change gives you more visibility and control over how vulnerabilities are managed during engagements and continuous offerings.

Vulnerabilities display with any one of the following states on the Vulnerabilities page in the NetSPI Platform and/or remediation reports. Each Vulnerability state's meaning is described below. States can move from one state to another state.

Vulnerability states set by NetSPI Platform users

Vulnerability State	Condition
Remediation in Progress	You can set a state to Remediation in Progress while you are working on a vulnerability to keep track of the remediation process. Only available after the initial report has been delivered for point-in-time engagements. For continuous engagements, available at any time.
Ready for Retest	You can set a state to Ready for Retest when you have remediated it from your end and want NetSPI to retest it to confirm the vulnerability is resolved. Only available after the initial report has been delivered for point-in-time engagements. For continuous engagements, available at any time. Note: Moving to the Ready for Retest state does not automatically initiate a retest. Once all applicable vulnerabilities have been remediated, clients must schedule a retest through the platform or coordinate with their CDM to have the retest engagement initiated.
Remediated	You can set a state to Remediated when you have remediated the vulnerability, completed your own testing, and consider remediation complete; NetSPI does not retest in this state. Only available after engagement completion for point-in-time engagements. For continuous engagements, available at any time.
Accepted Risk	You can set a state to Accepted Risk when you acknowledge the vulnerability but consider it a low priority. NetSPI does not retest in this state. Only available after the initial report has been delivered for point-in-time engagements. For continuous engagements, available at any time.
False Positive	You can set a state to False Positive only when the engagement is set to complete, or you have a continuous engagement.

Finding states set by NetSPI Platform agents

Vulnerability State	Condition
Open	The Open vulnerability state is set by the NetSPI Agent when they publish a new, verified vulnerability for your organization.
Not Remediated	The NetSPI Agent sets the vulnerability state to Not Remediated if that specific vulnerability or risk is still present.
Remediation Verified	The NetSPI Agent sets the vulnerability state to Remediation Verified once they have tested and confirmed the vulnerability has been fixed by your organization.
Unable to Retest	The NetSPI Agent sets the vulnerability state to Unable to Retest for a variety of reasons that will be included along with the state. This state is often applied to groups of published vulnerabilities that are unable to be retested.
Retesting Not in Scope	The NetSPI Agent sets the vulnerability state to Retesting Not in Scope when it’s not included in the scope of work.

Vulnerabilities and the different NetSPI Platform modules

If you subscribe to more than one NetSPI Platform module (i.e., PTaaS, EASM, and/or BAS) then your vulnerabilities are viewed and treated by each of the different modules as described below.

A vulnerability created by the following:	Displays/acts as follows under the following module activity:
PTaaS engagement	The Vulnerability State is updated and used by both PTaaS and EASM if an EASM scan discovers a vulnerability affecting an asset in the PTaaS engagement.
PTaaS engagement or EASM with a CVE (Common Vulnerabilities and Exposures)	The Vulnerability State table displays the CVE ID for that vulnerability.
PTaaS engagement and BAS	The Vulnerability State is updated and is used by both BAS and PTaaS when a BAS play runs that affects an asset in that PTaaS engagement.
EASM	The vulnerability state table displays EASM in the Identified By column in the Vulnerability State table.

Engagement and Continuous Vulnerability State Flow Diagrams

Engagement Vulnerability State Flow

Continuous Vulnerability State Flow