Skip to main content

Triage Workflow

Path: /vulnerabilities · Sidebar: Findings → Vulnerabilities

Triage is how a raw scanner queue becomes a trustworthy, actionable list. apPosture combines a clean workflow with AI assistance and an ML noise filter so the team spends time on what's real.

The lifecycle​

new → triaged → in progress → fixed / risk-accepted / muted

For each finding you can:

  • Assign an owner and set status.
  • Confirm / dispute - mark a true or false positive (this trains the model).
  • Risk-accept - accept a real issue with an owner + expiry (it resurfaces on expiry).
  • Mute - suppress noise without deleting (see Mutes).
  • Ticket - push to Jira / ServiceNow / Azure DevOps and sync status back.

What makes the queue trustworthy​

  • Deduplication - one unified finding per root cause across scanners, not N copies.
  • Evidence on every finding - a proof-of-exploit (PoC request/response) or a precise code location, plus a secure-code fix.
  • ML triage - a classifier learns your team's FP history and down-ranks likely-noise; confirmed findings rise.
  • Reachability - code/dependencies that aren't actually reachable are deprioritised.

AI copilot​

The triage copilot explains a finding, its business impact and a fix - but every claim is cited; uncited assertions are dropped (no hallucination), and sensitive data is masked. Ask questions in natural language with Ask AI.

Prioritisation​

The Priorities funnel turns hundreds of findings into the few that are reachable + exploit-confirmed + KEV/known-exploited - the "fix this first" set, backed by proof.

Last updated on