Resolve Vulnerabilities

Vulnerabilities detected via integrated scanners or uploaded manually from a penetration test (pentest) must be resolved within the defined SLA to maintain a compliant posture.

Sprinto distinguishes between vulnerabilities based on their source:

• Scanner-based vulnerabilities: Automatically synced and updated by Sprinto.
• Pentest-based vulnerabilities: Require manual closure after mitigation.

You can also mark non-relevant issues as special cases if required.

Before You Begin

Ensure that:

• You have administrator access to Sprinto.
• For scanner-based vulnerabilities, the source system is updated with the fix.
• For pentest-reported vulnerabilities, you’ve completed the required mitigation.
• You are familiar with special case handling if a vulnerability cannot be resolved.

Procedure

1. Navigate to Vulnerabilities

1. Log in to the Sprinto admin portal.
2. Go to Data Library > Vulnerabilities.
3. Select the appropriate monitoring source from the left-hand menu, or click Pentest to view uploaded vulnerabilities.

2. Resolve Scanner-based Vulnerabilities

1. Select a vulnerability with status Due, Pending, or Failing.
2. Review its details, including:
   • Resource type
   • Category
   • Severity
   • Due date
   • Assigned owner
3. Remediate the issue directly at the source (e.g. AWS Inspector, GitLab, Snyk).
4. Once the vulnerability is closed at the source, Sprinto automatically syncs the updated status and marks the corresponding check as Passing.

3. Resolve Pentest-reported Vulnerabilities

1. Go to the Pentest tab under Vulnerabilities.
2. Click the Vulnerabilities sub-tab.
3. Find the relevant item in Open status and take the necessary mitigation action.
4. Once resolved, click Close next to the vulnerability.
5. Enter:
   • Closure date
   • Closure reason
6. Click Close Vulnerability to confirm.

4. Mark as Special Case (Optional)

If the vulnerability is not relevant or cannot be resolved, mark it as a Special Case:

1. Select the open vulnerability from either a scanner or pentest source.
2. Click Mark as Special Case.
3. Enter a justification in the remarks field.
4. (Optional) Upload a supporting document.
5. Choose one of the following:
   • Valid forever
   • Let me select an expiry date
6. Click Mark as Special Case to save.

This action marks the check as Passing, but the entry remains visible in compliance logs.

Result

• Scanner-based vulnerabilities are auto-synced and marked Resolved upon source remediation.
• Pentest vulnerabilities are manually closed in Sprinto after mitigation.
• Special case vulnerabilities are excluded from failure checks but retained for audit.