A finding is one issue on one asset. It keeps the same identifier — `FND-` followed by a hex string — for its entire life.

## The findings list

Columns: severity, ID, title, asset, status, assignee, priority score, first seen and last observed.

**Priority** and **severity** are different. Severity is how bad the issue class is; priority is how urgently *you* should deal with *this* instance, factoring in exploitability, internet exposure, asset importance and age. Sort by priority when deciding what to do next. See [How scores are calculated](how-scores-are-calculated).

Filter by search text, status, severity, organization, asset and assignee — filters combine with AND. Sort by severity, priority, first seen, last observed or status.

## Statuses and allowed transitions

| From | Can move to |
| --- | --- |
| **Open** | Acknowledged, In Progress, False Positive, Closed |
| **Acknowledged** | In Progress, Closed, False Positive |
| **In Progress** | Closed, Risk Accepted, False Positive |
| **Closed** | Open |
| **Risk Accepted** | Open |
| **False Positive** | Open |

Anything not in this table is rejected.

Two consequences worth knowing:

- **Risk Accepted is only reachable from In Progress.** You cannot accept a risk straight from Open — someone has to pick the finding up first. This is deliberate: risk acceptance should follow investigation, not replace it.
- **Risk Accepted and False Positive cannot go directly to Closed.** Reopen them first.

Moving to Closed or False Positive records a closure timestamp and reason; reopening clears both. Every change is written to an append-only event log with the actor and reason.

## The detail panel

Click a finding to see its description and remediation guidance, the affected asset, first and last seen timestamps, **occurrences** (each time a scan observed it), **assignments**, and the full **event timeline**.

## Assigning work

Assign a finding to a colleague with an optional due date. Assignees with the Remediator role see **only** their assigned findings and those findings' assets — nothing else in the workspace.

Select up to 100 findings at a time for bulk status changes or bulk assignment.

## Rescanning

Findings found by a scan have a **Rescan** button. It re-runs only the relevant checks against that asset.

Perimeter polls for the result and tells you one of three things: the rescan is still running; the issue is still present; or the signal is gone — in which case it offers a **Close case** action.

> Findings imported from an external source cannot be rescanned. Their state comes from the next import.

## Automatic closure

You don't have to close everything by hand. When a full scan runs and a previously-seen finding is no longer observed, Perimeter closes it and records why:

- **Not observed in scan** — a full scan no longer saw it.
- **Remediated or not observed** — a targeted rescan no longer saw it.
- **No longer present in source** — it disappeared from an external import.

Findings are never deleted. A closed finding that reappears is reopened against the same record, so the history of a recurring problem stays in one place.

## SLA

Each finding gets a deadline based on severity. Defaults are 72 hours for critical, 7 days for high, 30 days for medium and 90 days for low. Informational findings use the low target.

Your dashboard has an **SLA At Risk** card. Administrators can set custom per-organization targets.