Overview
This article explains how to change the status of a finding in the Cye platform.
As a finding moves through your organization's remediation process, it's important to keep its status up to date — not only for clarity, but also because status changes affect risk calculations, reports, and the Org. Attack Graph.
1. Choose the appropriate status
You can move a finding between any status — the system does not require a specific sequence. Available statuses include:
Open – The default status for newly discovered findings
To Do – A finding waiting to be addressed
In Progress – The finding is being handled, but not yet resolved
Reopen – The finding was previously marked as Fixed but has been reopened
On Hold – The finding is paused or temporarily deferred
Fixed – The finding has been remediated and closed
Acceptable Risk – The finding is not being remediated because the risk is considered tolerable
Not Relevant – The finding is linked to an asset that no longer exists or is out of scope
2. Marking a finding as Fixed
When you select Fixed, a window appears prompting you to describe what was done to resolve the issue.
This explanation will be saved as a comment in the Project tab, labeled Marked as fixed:
The status change also appears in the History tab
After setting a finding to Fixed:
All associated remediation assets must be marked Fixed, Acceptable Risk, or Not Relevant
The system automatically updates edges in the Org. Attack Graph and recalculates likelihood or exposure
3. Marking Partially Remediated Findings as Fixed:
You can mark a finding as Fixed before remediation progress reaches 100%. This applies to both individual and bulk updates.
When set to Fixed:
Metrics frozen: Exposure Reduction and Priority are calculated based on progress achieved so far and then frozen.
Platform behavior: The finding acts as Fixed across the entire platform, including the Attack Graph.
Maturity calculation: Maturity is automatically set based on linked remediation assets. If no assets are linked, it defaults to 3. You can manually override Maturity at any time on the Finding page.
3. Verifying the fix
4. After a finding is marked Fixed, it must be verified.
Verification can be done by a Cye platform user, the CYE service team, or both — depending on your engagement agreement
Once verified, the finding displays a green shield icon in the Findings list
Wrap-up / Next Steps
Keeping statuses current helps everyone understand the state of risk — and ensures the Cye platform's calculations stay accurate. If you've fixed something, be sure to mark it and verify it properly.