Verified closure
A fix isn't "done" on someone's word: it closes only when it's confirmed.
Findings
Not fixed until proven
Every finding is owned, ranked by the risk it really poses, and closed only when the fix is verified.
Problem
A list of issues isn't a plan to fix them
Findings scatter across scanners, spreadsheets and PDF reports. Pull them together and the same three problems keep showing up.
- 1DuplicatesThe same CVE, reported twice by two scanners, under two different names for the same server.
- 2"Fixed?"Someone said it's patched. Nothing re-checked it.
- 3"Accepted?"No record of who made the call, why, or when it should be looked at again.
How we solve it
One place where every finding gets driven to a verified fix
Fixed and proven
Each weakness becomes a tracked ticket, assigned to an owner, prioritised by the risk it actually poses, and closed only when the fix is confirmed.
Accepted and on the record
Choose to accept a risk instead? That decision is written down and signed off. The result is remediation you can prove and measure, not a backlog you hope is shrinking.
Key features
From finding to fix, on the record
Unified queue
Vulnerabilities and misconfigurations in one lifecycle.
Governed risk acceptance
Accept a risk only with a written reason and a sign-off, so "we're not fixing this" is a recorded decision, not a gap someone forgot.
SLA tracking
Deadlines come from your remediation policy. On track, due soon and overdue surface on their own.
Import, export, filter
Move findings in or out by CSV, and slice the view by owner, severity, status, asset and more.
Risk-based priority
The priority matrix ranks each finding by its severity against the affected asset's real risk, so you fix what matters first.
How it works
From first finding to proven fix
- 1Open
It lands in the queue
From a hardening audit, a pentest, a CSV or by hand. Bound to its asset, evidence attached.
- 2In Progress
Triaged and assigned
An owner, a rank based on the asset's real risk, and a deadline from your policy.
- 3Under Review
The fix goes in
The assignee believes it's done. Belief isn't proof yet.
- 4FixedorRisk Accepted
Proven, or accepted
A re-test confirms the fix, or the risk is accepted with a written reason and sign-off.
FAQ
Everything you need to know
What is a security finding?
A specific, tracked issue that needs attention: a vulnerability or misconfiguration discovered on one of your assets. Unlike a raw scan result, a finding has a lifecycle. It's owned, prioritised, worked, and closed only when it's resolved or formally accepted. It's the unit of remediation.
What's the difference between a vulnerability and a misconfiguration?
A vulnerability is a flaw in the software itself, usually a known CVE, and it's fixed by patching or upgrading. A misconfiguration is software set up in an unsafe way, like SSH root login enabled or TLS 1.0 still on, and it's fixed by changing the setting. Panopsys tracks both in the same lifecycle.
What's the difference between remediating a finding and accepting the risk?
Remediating removes the weakness with a patch, an upgrade or a configuration change, and a re-test confirms it's gone. Accepting the risk is a deliberate decision to live with it. In Panopsys that takes a written reason and a sign-off, so "we're not fixing this" is a recorded decision, not a gap someone forgot.
Why isn't a finding closed as soon as it's fixed?
Because "fixed" is a claim until someone checks it. When the assignee applies the fix, the finding moves to Under Review. It only becomes Fixed once a re-test or validation confirms the weakness is gone.
What is a remediation SLA?
The deadline for fixing a finding, set by your remediation policy for each severity, for example 2 days for critical and 14 days for high. Each finding gets its due date when it's triaged, and Panopsys shows whether it's on track, due soon or overdue.
How do you decide which findings to fix first?
The priority matrix weighs each finding's severity against the real risk of the asset it sits on. A high-severity issue on a critical, internet-facing asset comes before a critical one on an isolated test machine, so the top of the queue is the thing to fix today.
Can I import and export findings?
Yes. Bring findings in from a CSV and export any view back out to CSV. Before you export, filter the list by owner, severity, status, asset and more.