Managing a vulnerability's lifecycle

Last updated: October 19, 2026

Vulnerabilities in the platform follow a lifecycle that lets you track them from detection to resolution. Managing this process well is key to reducing risk in a sustained way.

Vulnerability statuses

Each vulnerability has a status that shows what stage of management it is in:

Status

What it means

Pending fix

The vulnerability was detected and validated, and is pending remediation.

In progress

Remediation is in progress.

Fixed

The vulnerability was fixed. You can mark it yourself when your team applies the fix, and a retest with a Fixed result marks it as verified by Strike.

Accepted risk

Your organization decided to accept the risk and not remediate the vulnerability.

Discarded

The vulnerability was discarded. For more details, see Managing discarded vulnerabilities.

Management flow

The typical lifecycle of a vulnerability is:

  1. Detection: Strike's AI agent identifies it during a Threat Emulation run.

  2. Validation: Strike's Hacking Team reviews it before reporting it.

  3. Prioritization: your team decides what to remediate first, based on severity and the relevance of the asset.

  4. Remediation: your team fixes the vulnerability and can mark it as Fixed.

  5. Retest: the fix is validated. If the result is Fixed, the vulnerability is verified by Strike.

  6. Closure.

In addition, on each run the platform automatically revalidates the reported vulnerabilities. If you want to validate a specific fix, you can request a retest. For more details, see How to request a retest and How to interpret retest results.

Expert validation of findings

All findings are triaged by Strike's Hacking Team before being reported, and critical ones are also reproduced and validated manually. In this process, the team:

  • Filters out false positives.

  • Confirms that the findings are actually exploitable.

  • Assesses the real impact.

  • Ensures the quality of the results.

This way, every reported vulnerability has real context and is actionable. The combination of artificial intelligence and human validation reduces noise and improves testing accuracy. To see how each finding was evaluated, see Tracking triage and AI validation.

Vulnerability tracking

The platform lets you:

  • Monitor the status of each vulnerability.

  • See how it evolves over time.

  • Identify the backlog pending remediation.

Best practices

  • Continuously track vulnerabilities in Pending fix and In progress.

  • Avoid letting the backlog build up.

  • Always validate remediation with a retest.

  • Prioritize based on the severity of the vulnerability and the relevance of the asset.

  • Use Accepted risk only when your organization makes a conscious decision not to remediate a vulnerability.

Effective lifecycle management not only lets you fix vulnerabilities, but also reduces the time your systems remain exposed.