Issues and Action Plan
The Issues and Action plan tabs on Security posture list the findings behind your score and tell you what is worth fixing first.
Issues tab
A table of every finding considered for the selected score, 25 rows per page, with a search box ("Search issues") that searches the title, asset, section and reason.
Quick filters: All, Counted, Not counted.
Facets: Section, Severity, Classification (searchable) and Status.
Scope chips: after you pick a section tile or a single issue, "Section: X" and "One issue" chips appear with a cross to clear them.
Empty results read "Nothing matches, try another facet or search."
Counted and Not counted
The Issues tab lists the findings behind the Security score. It keeps the 1,500 that matter most (highest points first), which is far more than most organisations have.
- Counted issues deduct points from their section. The Points column is what the issue costs.
- Not counted issues do not deduct, and the Why column says so. The reasons you will see here are: excluded ("not ours" or false positive), resolved, and accepted risk.
Some findings never reach this table because they are not part of the score at all: context and inventory facts, findings below a check's relevance floor, findings on a shared network edge, and results no section covers. They are recorded on the run itself: open the run and look on its Findings tab, where they are marked as context or "Not a rating check".
The issue pane
Click a row to open the pane. It shows severity, Counted or Not counted, Points, Why, Section, Host, Classification, Status, Confidence, Seen, First seen, Last seen, the Recommendation, and a fix button. For findings that came from a discovery run, the pane is the run's read-only result view with previous and next controls.
Action plan tab
"The counted issues that cost the most points, in order. When a later run no longer sees an issue, its points go back to its section's score." Each row is numbered and shows severity, title, "section · asset" and "+N to
Severity is only one input. A medium seen on many hosts can cost more than a lone high, which is why the plan is ordered by points, not severity.
Fixing
Use the fix button on a row. Issues in the standard sections show Open in Exposures, which opens the Exposures list with that section applied. Brand Protection issues show Open in Brand Protection. Issues in Human Risk and Compliance have no fix button, because they are measures, not findings. The primary button at the top of the page, Fix top issue, takes you to the costliest issue.
After the fix, the next run that no longer sees the finding restores its points. Recompute now only refreshes the scores from runs that already exist; a new run is what proves the fix.
Human decisions change the security score
Status changes made on the detection (for example accepted risk, false positive, resolved) change how the finding counts in the security score. See Accepted risk, coverage and recompute.
Use cases and wiring tips
- Issues to tasks: Scoring does not create tasks for you. Copy the title, asset and points of the top issues into a task in Tasks, assigned to the owner of that asset. The task is truly done when the next run no longer sees the issue and the row moves to Fixed issues in History.
- Sprint planning: take the top ten from Action plan; the points give a ready estimate of the grade effect.
- Triage debt: filter Not counted plus the Status facet to review what you have accepted or excluded, and whether each decision still holds.