Vulnerability states and definitions

Vulnerabilities display with any one of the following states on the Vulnerabilities page in the NetSPI Platform and/or remediation reports. Each vulnerability state's meaning is described below. States can move from one state to another state.

Vulnerability states set by NetSPI Platform users

Vulnerability State	Condition
Remediation in Progress	You can set a state to Remediation in Progress while you are working on a vulnerability to keep track of the remediation process. Only available after the initial report has been delivered for point-in-time engagements. For continuous engagements, available at any time.
Ready for Retest	You can set a state to Ready for Retest when you have remediated it from your end and want NetSPI to retest it to confirm the vulnerability is resolved. Only available after the initial report has been delivered for point-in-time engagements. For continuous engagements, available at any time. Note: Moving to the Ready for Retest state does not automatically initiate a retest. Once all applicable vulnerabilities have been remediated, clients must schedule a retest through the platform or coordinate with their CDM to have the retest engagement initiated.
Remediated	You can set a state to Remediated when you have remediated the vulnerability, completed your own testing, and consider remediation complete; NetSPI does not retest in this state. Only available after engagement completion for point-in-time engagements. For continuous engagements, available at any time.
Accepted Risk	You can set a state to Accepted Risk when you acknowledge the vulnerability but consider it a low priority. NetSPI does not retest in this state. Only available after the initial report has been delivered for point-in-time engagements. For continuous engagements, available at any time.
False Positive	You can set a state to False Positive only when the engagement is set to complete, or you have a continuous engagement.

Finding states set by NetSPI Platform agents

Vulnerability State	Condition
Open	The Open vulnerability state is set by the NetSPI Agent when they publish a new, verified vulnerability for your organization.
Not Remediated	The NetSPI Agent sets the vulnerability state to Not Remediated if that specific vulnerability or risk is still present.
Remediation Verified	The NetSPI Agent sets the vulnerability state to Remediation Verified once they have tested and confirmed the vulnerability has been fixed by your organization.
Unable to Retest	The NetSPI Agent sets the vulnerability state to Unable to Retest for a variety of reasons that will be included along with the state. This state is often applied to groups of published vulnerabilities that are unable to be retested.
Retesting Not in Scope	The NetSPI Agent sets the vulnerability state to Retesting Not in Scope when it’s not included in the scope of work.

Engagement and Continuous Vulnerability State Flow Diagrams

Engagement vulnerability state flow

Continuous vulnerability state flow