Vulnerabilities and exposure
Findings, carry-forward and dismissals
What a finding shows, why a finding from a heavier scan survives a lighter one, and the four reasons a finding, a software reading or an alert can be silenced.
Updated · 2 min read
What a finding shows
Severity as a word (High, Medium, Low; the CVSS number stays on the card), where it was found (the host and the check), the title, why it matters, the next action (for a KEV entry, CISA's deadline and the published fix as numbered steps), an evidence list, and two actions: Mark as done and Ask NHM.
In the app, Simple view says what the finding means in plain words and folds the technical rows behind "Show the technical detail"; Advanced keeps the CVSS rail, the source line and the evidence. Switch under Account, App detail. Simple hides no finding.
Carry-forward
A nightly scan runs fewer tools than a deep scan. Without carry-forward, the morning after a deep scan a domain could read "0 high", not because anything was fixed but because the tool that found it did not run again. Findings therefore persist until a scan that ran the same check either re-finds them or does not; each is labelled with the date it was last checked.
Marking done
"Mark as done" asks why:
| Reason | Effect |
|---|---|
| Fixed | Re-checked by the next scan that runs the same tool; comes back if still present |
| False positive | Silenced for good |
| Accepted risk | Silenced for good |
| Not applicable | Silenced for good |
The last three are dismissals. A dismissal is keyed to what the result is (its stable key from the scan result), not its row id, so it survives re-scans, and it applies per domain when a domain is given. Dismissals cover three kinds: a scan finding, a software inventory reading, and a KEV/CVE alert.
- Web: Security, Dismissed; the finding's Mark as done.
- iOS: Watchlist, Dismissed to see and restore.
- API/MCP:
GET/POST /api/vuln-scan/dismissals(?kind=finding|component|alert),DELETE /api/vuln-scan/dismissals/:id; toolslist_vuln_dismissals,dismiss_vuln_finding(kind,target_key,reason, optionaldomain_id,label,note),restore_vuln_dismissal.
Restoring
Undoing a dismissal makes the finding, reading or alert report again on the next read. Nothing is deleted by a dismissal; the record and the reason stay in the account for audit.
Where this comes from (Advanced view)
Under the list: how many domains were compared, how many products are on the watchlist, how many open services were seen, and when the last deep scan ran. Anything nothing has measured shows a dash.
Common questions
A finding disappeared without me touching it. Either a scan that ran the same tool did not re-find it (it is fixed), or the domain lost clearance and only passive checks ran; the last-checked date tells you which.
Can I dismiss for the whole account? Omit the domain when dismissing a KEV/CVE alert or a software reading; a scan finding is always per domain.
Keep reading
Related articles
- Widgets and the Lock ScreenFour Home Screen widget sizes and three Lock Screen widgets: what each shows, how they refresh, how to add one, and what a dash means.iOS app ·Updated
- Scan clearance and ownership proofProve you control one domain on the account (DNS record, file, or an email link) and every domain is cleared for 90 days. Protected targets and authorisation.Vulnerabilities and exposure ·Updated
- Software inventory and vendorsWhat your scans proved the site runs, split into versioned software that can be checked and software only seen; confidence, detector and last-seen; and vendors.Vulnerabilities and exposure ·Updated