Skip to content

Results, Issues & Triage

This section provides guidance on understanding, managing, and triaging security findings from Escape's security testing products (ASM, Business Logic Aware DAST, and AI Pentesting).

Understanding Results

Security testing results include vulnerabilities, sensitive data exposures, and other security findings discovered during scans. Understanding how to interpret these results is crucial for effective security management.

Product-Specific Results

Common Elements

All security findings share common elements:

  • Severity: Risk level (Critical, High, Medium, Low, Info)
  • Evidence: Proof of the vulnerability or exposure
  • Reproduction Steps: How to reproduce the finding
  • Remediation Guidance: Recommendations for fixing the issue
  • Context: Application context, environment, and exposure status

Issue Management

Issue Management provides tools for identifying, prioritizing, and remediating security issues at scale.

Key Capabilities:

  • Bulk Operations: Manage hundreds or thousands of findings simultaneously
  • Prioritization: Risk-based prioritization using severity and business impact
  • Filtering & Search: Advanced filtering and query builder for finding specific issues
  • Status Tracking: Track remediation progress and status

Triage Workflow

Effective triage involves:

  1. Review Findings: Understand what was discovered
  2. Reproduce: Verify findings can be reproduced
  3. Assess Impact: Evaluate business and security impact
  4. Prioritize: Rank findings based on severity and impact
  5. Coordinate Remediation: Share findings with the responsible teams or individuals
  6. Track: Monitor remediation progress
  7. Verify: Confirm fixes after remediation

Best Practices

  • Start with Critical Issues: Focus on high-severity findings first
  • Validate Findings: Reproduce findings before assigning
  • Use Bulk Operations: Leverage bulk editing for efficiency
  • Track Progress: Monitor remediation status regularly
  • Document Decisions: Record why issues were ignored or accepted