Home / Knowledge hub / Remediation guidance
Knowledge hub
Remediation guidance
The advice in a report on how to fix a finding, ideally down to the code.
What it means
Remediation guidance is the part of a finding that tells your team how to fix it. At its weakest it is a sentence copied from a standard. At its best it names the file and line, shows the fix in your framework, and says how to confirm that the fix worked.
It is the step between 'here is a problem' and 'it is gone'. A report without it leaves developers to work out the cure themselves, usually while trying to understand the problem for the first time and under pressure to close the ticket.
Why it matters
Fix speed depends on how much thinking is left to do. Advice such as 'validate all input' means a developer must find the right place, choose a method and test it. A specific change in a specific function can be reviewed and shipped the same day.
Bad advice is worse than none. A fix that blocks one payload and leaves the flaw, such as filtering a single bad string, passes a quick check and fails against the next attempt. It then comes back as a repeat finding, and trust in the report falls.
How it shows up
Look for four things: the root cause in plain words, the exact place in the code or configuration, a recommended change that fits your stack, and how to verify it. Where there are options, a good report says which is preferred and why. It also links to a reference such as the OWASP Cheat Sheet Series.
Prefer fixing the cause over blocking the symptom. Use parameterised queries instead of filtering quotes, and an ownership check on the server instead of hiding a link. Then prove it: the exact exploit is run again against the new code (see fix verification). Advice you cannot test is advice you cannot trust.
Questions people ask
Remediation guidance, answered
What should good remediation guidance include?
The cause, the location, a concrete change, an alternative if the first is not possible, and a way to check the fix.
Links to a recognised reference help the developer go deeper.
Is remediation the same as mitigation?
Remediation removes the flaw. Mitigation reduces the chance or impact of it without removing it, such as a filter in front.
A report should say which it is recommending.
Can guidance be generated automatically?
Tools can propose fixes, and some are good. Someone who knows the codebase should still review them, because a plausible fix can break behaviour or miss the cause.
Always test the result.
Why is generic advice a problem?
It adds work for the person fixing and invites partial fixes. 'Sanitise input' can mean ten different things.
Specific guidance for your framework, with an example of the corrected code, avoids that.
Who is responsible for the fix?
Your team owns the change, because only it knows the codebase and the release process. The tester explains the problem and suggests the cure, then confirms it afterwards through a retest.
See remediation.
Sources
Where this comes from
Related
Terms that sit next to this one
Remediation
The actual work of fixing a finding: the change, the review, the release.
Fix verification
Proving a fix works by repeating the original exploit against the new code.
Root cause
The underlying mistake behind a flaw, which fixing prevents a whole class from returning.
Security finding
One confirmed weakness in a report, with the evidence to show it is real.
Penetration test report
The document that lists what was found, how, how bad it is and how to fix it.
Where exactly is the fix?
In white-box mode we read your code while testing the running app, so a finding can point to the file and line. We then re-run the same exploit to prove the fix. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.