Managing discarded vulnerabilities

Last updated: October 19, 2026

During triage, some findings are determined to be invalid and are discarded. These discarded findings are visible in the platform, in a section separate from your active vulnerabilities.

The goal is to give you full transparency: you see not only the confirmed findings, but also everything Strike evaluated and decided to discard, along with the reason.

What a discarded vulnerability is

A vulnerability is discarded when, once its triage is complete, it receives a result other than Valid. The possible reasons are:

  • False positive: it is not a real vulnerability.

  • Not reproducible: the base behavior could not be reproduced.

  • Out of scope: the asset, host or functionality is outside the scope.

  • Duplicate: the finding is real, but it was already reported before.

  • Needs more context: information needed to reproduce it is missing.

  • Needs more evidence: the bug is plausible, but its impact is not sufficiently demonstrated.

Discarding findings is a normal part of testing: it reflects the noise filtering that makes confirmed findings reliable. A discarded vulnerability appears with the Discarded status. To see the other statuses, see Managing the vulnerability lifecycle.

Where they are shown

Discarded vulnerabilities are never mixed with valid ones. They are in a separate section, so your main view stays focused on the findings that require action.

This way you can review what was discarded and why whenever you need to, for example during an audit or when validating testing coverage, without that detail interfering with your daily work.

Why you see these findings

Previously, only confirmed vulnerabilities were shown. Now, by default, you can also see discarded findings, so you have full visibility of the work performed.

Every finding goes through the AI Triager and through review by Strike's Hacking Team, and in its triage history you can see the detail of each decision. For more detail, see Tracking triage and AI validation.

Best practices

  • Use the discarded section to audit testing coverage.

  • Review the triage history if you want to understand why a finding was discarded.

  • Keep your operational focus on active vulnerabilities.