Read your findings
A scanner hands you a queue, and the work is deciding which few are worth an afternoon. Two numbers do most of that sorting, and they are answering different questions.
Contents
Before you start
- A finished scan with results in Intel, then Findings.
1Read severity and confidence separately
Severity says how bad it is if it is real. Confidence says how sure the engine is that it is real. A high severity at low confidence is a thing to reproduce; a low severity at high confidence is a thing to schedule. Sorting on severity alone is how a queue turns into noise.
You should seeBoth values on every row in the findings list.
2Trust the out-of-band ones first
Some classes leave no visible trace in the response. For those, the engine injects a unique callback address and waits for the target to reach a server you control. No interaction, no finding. When a finding says it was confirmed out of band, the target executed the payload, and there is no reading of the response that argues it away.
You should seeThe confirmation noted on the finding itself.
3Reproduce the ones you doubt
Open a finding and send the request again by hand from Bench, then Repeater. Edit it, resend it, and watch what changes. If you cannot make it happen twice, it does not go in a report. This is also the honest way to close out a finding you think is wrong.
You should seeThe same request, your edits, and the response side by side.
4Work the queue, not the list
Filter by severity, by host, and by whether the discovery was active or passive. If the queue is large, Valkyrie ranks it and attaches its reasoning rather than a bare score. Triage reads findings that already exist: it sends nothing at a target and it cannot turn an unconfirmed finding into a confirmed one.
You should seeA shortlist worth an afternoon instead of two hundred rows.
5Get it out of the dashboard
Export the filtered set to CSV, JSON or Markdown, for a report or for whatever comes next in your pipeline. Each finding keeps its own link, so one can be sent to whoever owns the fix without sending the rest.
You should seeA file with exactly the rows your filters left.
When it does not work
Everything came back clean. Is that real?
Check what was tested before you believe it. An empty queue after a scan that never got past a login, or that crawled twelve endpoints of an application with two hundred, is a coverage result and not a security result.
How do I know a finding is not a false positive?
Reproduce it. Out-of-band confirmation does this for the blind classes automatically; for everything else the Repeater takes about a minute. A finding you cannot reproduce is a lead, not a result.
Does triage cost anything?
Scanning within your plan limits is unlimited and costs no credits. Valkyrie triage consumes AI credits, which your plan grants each term and which you can top up. The split keeps an expensive feature from making an ordinary scan expensive.
Next: Scan behind a login