Guide
A closed ticket is not evidence that risk was removed. This guide explains how to produce verified remediation evidence: independent corroboration that the original finding no longer applies, bound to a specific release decision.
Development teams mark vulnerabilities as fixed every day. But "fixed" often means the ticket was closed or a scanner no longer reports the issue in a single run. When a consequential release depends on that fix, the organization needs proof, not belief.
Capture the original scanner output, location, version, and context. Without the original evidence, later verification cannot compare outcomes. The finding is the baseline.
Record the commit, build, or deployment that contains the claimed fix. The artifact must be identifiable and reproducible. In multi-repository vulnerability remediation, the fix may span several repos and services.
Run the original test or scanner against the new artifact. Where possible, add a second independent source such as runtime telemetry or reviewer attestation. Two findings from the same scanner do not double the confidence.
The only honest outcomes are: risk absent, risk present, or indeterminate. Indeterminate must be escalated, not promoted to fixed.
The verified evidence is evaluated against the policy version active at release time. The decision record links the original finding, the fix artifact, the verification evidence, and the release outcome.
| Evidence level | What it means | Example |
|---|---|---|
| Detected | A scanner or agent reported the issue | SAST flags a SQL injection pattern |
| Observed | The finding is confirmed in context | Reachability analysis shows the function is called |
| Corroborated | An independent source confirms the finding | Runtime telemetry matches the static finding |
| Validated | Independent evidence shows risk is absent | Retest and reviewer attestation confirm the fix |
Ticket closure is a workflow state. It records that someone believes the work is done, not that the risk was removed. Proof requires evidence that the original finding no longer applies in the new artifact.
Verified remediation evidence includes a retest result showing the original behavior is absent, a reviewer attestation with artifact references, and corroboration from independent sources. The evidence must be bound to the specific release decision.
Closed-loop remediation means the original finding, the fix, the verification evidence, and the release decision are linked in a single record. The loop closes when evidence shows risk was retired, not when a ticket is closed.
GoSentrix re-evaluates the original evidence against the new artifact and compares outcomes. The only terminal states are risk absent, risk present, or indeterminate. Indeterminate is escalated, not auto-promoted.
How runtime evidence improves application-security prioritization.
How ASPM differs from vulnerability tracking and prioritization.
How GoSentrix qualifies evidence for consequential software decisions.
Canonical answers about verification, policy binding, and tool relationships.
GoSentrix verifies whether remediation evidence satisfies policy for a consequential release decision.
