Skip to content

Results, Issues & Triage

This section provides comprehensive guidance on understanding, managing, and triaging security findings from Escape's security testing products (ASM, Business Logic Aware DAST, and AI Pentesting).

Understanding Results

Security testing results include vulnerabilities, sensitive data exposures, and other security findings discovered during scans. Understanding how to interpret these results is crucial for effective security management.

Product-Specific Results

Common Elements

All security findings share common elements:

  • Severity: Risk level (Critical, High, Medium, Low)
  • Evidence: Proof of the vulnerability or exposure
  • Reproduction Steps: How to reproduce the finding
  • Remediation Guidance: Recommendations for fixing the issue
  • Context: Application context, environment, and exposure status

Issue Management

Issue Management provides powerful tools for identifying, prioritizing, and remediating security issues at scale.

Key Capabilities:

  • Bulk Operations: Manage hundreds or thousands of findings simultaneously
  • Prioritization: Risk-based prioritization using severity and business impact
  • Filtering & Search: Advanced filtering and query builder for finding specific issues
  • Assignment: Assign issues to teams or individuals for remediation
  • Status Tracking: Track remediation progress and status

Triage Workflow

Effective triage involves:

  1. Review Findings: Understand what was discovered
  2. Reproduce: Verify findings can be reproduced
  3. Assess Impact: Evaluate business and security impact
  4. Prioritize: Rank findings based on severity and impact
  5. Assign: Assign to appropriate teams or individuals
  6. Track: Monitor remediation progress
  7. Verify: Confirm fixes after remediation

Best Practices

  • Start with Critical Issues: Focus on high-severity findings first
  • Validate Findings: Reproduce findings before assigning
  • Use Bulk Operations: Leverage bulk editing for efficiency
  • Track Progress: Monitor remediation status regularly
  • Document Decisions: Record why issues were ignored or accepted