Triage tracking and AI validation

Every vulnerability Strike detects goes through a triage process: the review that determines whether a finding is real, how relevant it is and how it should be reported. That process is visible from each vulnerability, in its triage history.

This gives you full traceability: you can see how each finding was evaluated, who reviewed it and what decision was made, from detection to confirmation.

What the triage history is

Inside each vulnerability you will find a triage history section that records every evaluation performed on that finding. Each entry includes:

• Who performed the triage: Strike's AI Triager or Strike's Hacking Team.

• Triage status: where it is in the evaluation process.

• Triage result: the conclusion, once the evaluation is complete.

This way you have visibility of the entire evaluation process, not just the final result.

Triage statuses

Triage results

Once the triage is Completed, the finding receives one of these results:

• Valid: the bug was reproduced and its impact was demonstrated. The finding is a real vulnerability.

• False positive: it is not a real vulnerability (behavior by design, misinterpretation, incorrect agent context, etc.).

• Not reproducible: the base behavior could not be reproduced.

• Out of scope: the asset, host or functionality is outside the scope.

• Duplicate: the finding is real and valid, but it was already reported before.

• Needs more context: the setup needed to reproduce it is missing (credentials, secondary user, prior endpoint, role context, complete steps, etc.).

• Needs more evidence: the bug reproduces or is plausible, but its impact is not sufficiently demonstrated (theoretical impact, unproven chain, incomplete PoC).

Only findings with a Valid result move to your active vulnerabilities. The rest are considered discarded and are shown in a separate section. For more detail, see Managing discarded vulnerabilities.

The AI Triager

Before review by the Hacking Team, every finding is evaluated by the AI Triager, Strike's AI-based triage agent. Its evaluation is recorded in the triage history, identified as performed by the AI agent.

This gives you an immediate first read of the finding while the validation process continues. The combination of artificial intelligence and human validation reduces noise and improves accuracy, so every confirmed vulnerability has real context and is actionable.

Why it is useful

• Full traceability of how each finding was evaluated.

• Transparency about the role of AI and the Hacking Team's validation.

• More context to prioritize and make decisions.