Home / Help centre / Results & findings
Results & findings
What do New, Regression, Fixed, False Positive and Accepted Risk mean?
New means found for the first time. Regression means it was fixed and then found again. Fixed means a later scan did not detect it, or your team marked it. False Positive means it is not a real issue. Accepted Risk means it is real and you chose to live with it.
The short version
Triage states describe where a finding sits in its life. They show as a badge in the Triage column and as chips above the list.
How it works in Cyberlop
| State | Meaning | Set by |
|---|---|---|
| New | First time this issue was found on the target | The scan |
| Regression | Was fixed, then detected again | The scan |
| Fixed | No longer detected, or marked fixed | The scan or your team |
| False Positive | Judged not to be a real issue | Your team |
| Accepted Risk | Real, but the business accepts it | Your team |
In the finding dialog, the Disposition list offers Open (reopen), Fixed, False Positive and Accepted Risk. New and Regression are not on that list because the scan sets them.
Issues persist per target across scans. That is how the app can tell a regression from a new finding. A finding is auto-marked fixed only when the scan genuinely did not detect it again.
What to do next
Add a note when you choose False Positive or Accepted Risk. State the reason and who agreed. A short note saves a debate months later.
To change a state, read how to change a finding's status. To see only some states, read how the triage chips work. For background on closing out risk, see risk acceptance and the fixed and regressed issues tutorial.
If your team uses a service target for fixes, the states map neatly onto it: New and Regression are the open queue, while Fixed, False Positive and Accepted Risk are the closed ones. Count the first group. Track it over time.
Related questions
- How do I change a finding's status?
- How does the Hiding / Showing only switch on the Issues page work?
- How do I mark a finding as a false positive?
- How do I mark a finding as accepted risk?
- Will a finding I marked as a false positive come back on the next scan?
How to verify a vulnerability fix with fixed and regressed issues
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.