Skip to content

Working with Findings

Audience: All client users · Where: Findings in the sidebar (/findings) for the whole organization, or the Findings tab inside any assessment.

Overview

A finding is a single security issue Canima discovered: a vulnerability, misconfiguration, weak credential, or exposure. Findings are the heart of the platform; everything else (dashboard, analytics, reports) rolls up from them. You can view findings two ways:

  •   Org-wide

    Every finding across your assessments and attack-surface monitoring, from Findings in the sidebar.

  •   Per-assessment

    Only the findings for one engagement, from that assessment's Findings tab.

The org-wide Findings list

Each row shows a unique Code (e.g. F-2026-AF7F), the Title, the Type (Web App / External / Internal / ASM), the Status, the Severity, the CVSS score, the Affected asset, the Assessment it came from, and when it was Created. Click a title to open it; click the affected asset to open it in the Asset Library.

Controls:

  • Display toggle: Open / Closed / All. Open is the default working view.
  • Status, Severity, and Type filters.
  • Search by code, title or CVE… to jump to a specific finding.
  • Clicking a category in a chart elsewhere (for example on Analytics) opens this list with a Category filter chip; clear it with the chip's ✕.
  • Export CSV downloads the current list (with extra columns such as category, CWE, CVEs, description and remediation) for spreadsheets or ticketing.
  • Sort any column with the arrows in its header; choose visible columns and rows per page.

The per-assessment Findings list

Inside an assessment, the Findings tab shows the same data scoped to that engagement. It leads with Total Findings and a Findings by severity breakdown, then a table with Code, Title, Severity, Status, Category, CVSS, the affected asset (Affected URL for web apps, Affected host otherwise), and Created. Use Search by code, title or CVE… and the Status, Severity, and Category filters, plus Export CSV.

Select one or more retestable findings to reveal a Request retest bar that re-verifies them in bulk.

Reading a finding

Click any finding to open its detail page:

  • Title, with Severity and Status badges. Findings that are part of a chained attack carry an attack chain badge.
  • Description: what the issue is and why it matters.
  • Remediation: how to fix it.
  • Evidence: the tool output that proves the finding, so you can verify and reproduce it. Where available a finding also carries CVE references and a Proof of Concept.
  • Finding Details panel: severity, CVSS, status, how long it's been open, the affected host (linked to its asset), category, and CWE / affected parameter where relevant.
  • Tester Evidence: when Canima testers attach files or screenshots to a finding, they appear in their own Evidence card.
  • Notes from your testers: comments from Canima testers (marked Tester) and from your own organization (marked Your team).
  • Retests: past retests of this finding, with a Request retest button in the header when the finding can be re-verified.

Statuses and severities

Severity: Critical / High / Medium / Low / Info, driven by impact and (where available) CVSS score.

Status reflects where the finding stands:

Status Meaning
Confirmed Validated as a real issue.
Suspected Very likely real but not proven. Typically a high or critical issue identified from a vulnerable software version that couldn't be actively re-validated. Treat it as open and verify the version.
Accepted Risk Acknowledged and accepted rather than remediated.
Fixed Resolved.

Open vs. Closed

Confirmed and Suspected findings are open; Fixed and Accepted Risk are closed. In the org-wide list, the Open / Closed / All display toggle groups them for you so you can work the open items first.

Retesting a finding

After you remediate a finding, you can request a retest so Canima re-verifies it and updates its status. Retest is offered on Confirmed and Fixed findings, and not on findings marked Accepted Risk.

You can retest a single finding from its detail page, or several at once from the assessment's Findings tab. Internal retests run on one of your OVA appliances, which you pick when you request the retest.

Each entry in the Retests history shows its result (Fixed, Still Vulnerable, or Inconclusive) and how it was verified: Automated retest, or Verified by Canima tester with the tester's notes.

Retests don't cost extra capacity

Retests on covered engagements don't consume additional capacity. See Licenses & Credits.

Tips

  • Work from the Open view and sort by Severity to triage the highest-impact issues first. Check findings past your SLA targets on the Dashboard's Risk and Compliance card.
  • The Code (F-2026-…) is a stable identifier. Use it when referencing a finding in a ticket, email, or with Canima support.
  • Use Export CSV to push findings into your own tracker (Jira, ServiceNow, a spreadsheet).
  • The same finding recurring across engagements? Check Analytics → Recurring Issues to fix the root cause once.

Related: Assessment Overview · Reports · Analytics · Vulnerability Scanning