Managing Findings

A finding is the atomic unit of a pentest report. Every finding carries the information needed to understand, reproduce, and remediate a security issue.

The finding record

Every finding has these fields:

Creating a finding

From an engagement's Findings tab, click New finding.

Fill in the fields you have information for. You can save a partial finding and come back to complete it later.

The title is the only required field. Everything else can be added as you learn more.

Severity

Use the standard five-level scale:

• Critical — remote code execution, full system compromise, or direct data exposure with no authentication required
• High — privilege escalation, authentication bypass, or significant data exposure
• Medium — information disclosure, limited impact bugs
• Low — minor issues, hardening gaps
• Informational — observations that aren't vulnerabilities but are worth noting

Severity maps to color throughout ATHELOS — reports, findings lists, and the ATT&CK heatmap.

CVSS scoring

CVSS (Common Vulnerability Scoring System) is the industry-standard way to rate vulnerabilities. The score is a number from 0.0 to 10.0.

Rules of thumb:

• 9.0 to 10.0 — Critical
• 7.0 to 8.9 — High
• 4.0 to 6.9 — Medium
• 0.1 to 3.9 — Low
• 0.0 — Informational

The vector string documents the reasoning — attack vector, complexity, privileges required, user interaction, scope, and the CIA triad.

If you're not sure of the score, the official CVSS calculator at first.org provides a guided interface.

ATT&CK mapping

MITRE ATT&CK is a knowledge base of adversary tactics and techniques. Every technique has an ID like T1190 (Exploit Public-Facing Application) or T1078 (Valid Accounts).

Tagging findings with ATT&CK techniques:

• Links your findings to a shared vocabulary
• Enables the ATT&CK heatmap in reports
• Helps clients map your findings to their detection coverage

You can add multiple ATT&CK tags per finding.

Attaching affected assets

If the finding affects specific scope items — a particular server, an application, a user account — list them in the Affected assets field.

This helps the client understand exactly what's impacted.

Finding status

A finding moves through these states:

• Open — identified, not yet validated
• Confirmed — validated as a real issue
• False positive — investigated and found not to be an issue
• Retested — verified as fixed in a follow-up test

Status changes are logged in the audit trail.

Editing and deleting

Findings can be edited any time. Click into a finding to modify any field.

To delete a finding, use the menu at the top-right of the finding detail page. Deletion is permanent — the audit log records it, but the finding itself is removed.

If you want to keep the finding for reference but exclude it from the report, that's a report-level decision — leave the finding intact and deselect it when generating the report.

Sorting and filtering

The findings list supports:

• Sort by severity — critical first
• Sort by status — open first
• Sort by date — most recent first
• Filter by tag — ATT&CK techniques, custom tags
• Filter by status — to hide false positives

In reports

When you generate a report, findings are pulled into the technical sections automatically. You can:

• Include or exclude individual findings
• Reorder them within the report
• Sort by severity with one click

The report is a view over your findings, not a separate document. Editing a finding updates the report.

Where to go next

• Capturing evidence — attaching proof
• Generating reports — from findings to PDF
• Your first engagement — the full workflow