Triage workflow

Findings exists in the portfolio (every customer) and in each customer's workspace. It lists lasting problems from every source: external assessments, devices, Microsoft 365, vulnerabilities, code and the dark web.

A routine that works

1. Start with Act now. Home and each customer's Overview list the most urgent items first: tracked threats, known-exploited vulnerabilities, active malware, tampering, critical findings.
2. Filter the list by severity, status, category, source or KEV, or search. Filters stay in the address bar, so you can bookmark a view such as "critical and high, open, KEV".
3. Open a finding in quick look (click the row). Read the one-line summary, the evidence, the steps to fix it and its history without leaving the list.
4. Decide: fix it, assign it, ticket it, accept the risk, or mark it a false positive.
5. Let RevoSecure confirm the fix. Don't resolve fixed findings by hand if a check covers them: the next assessment or agent report resolves them, which proves the fix.

Statuses

Select several findings to change them together. Every change is recorded in the finding's history and the audit log.

Assign, comment and ticket

From the quick look or the full page you can:

• assign the finding to a team member and set a due date;
• comment, for the next technician;
• create a PSA ticket in your connected ConnectWise PSA, Syncro, Atera or HaloPSA (see PSA ticketing);
• ask the AI analyst for an analysis (verdict, priority, exploitability, verification steps) or a remediation plan (see The AI analyst).

Lifecycle: auto-resolve and reopen

Findings are de-duplicated across runs, so re-running an assessment updates the same finding rather than adding a new one.

• Auto-resolve. When a later check that covered the finding passes, the finding is resolved automatically. Its timeline shows Resolved automatically and why (for example "Not detected by assessment … on 2026-10-28").
• Rechecked right after a fix. When Revo installs updates, upgrades Windows or restarts a device, it asks the device for a fresh collection straight away (after the restart, when one was needed), so findings the change fixed resolve within minutes instead of at the device's next regular report. It keeps asking (a few times, for up to a day) until a report collected after the change has been processed. Devices need RevoAgent 0.5.0 or later.
• Removed devices. Removing a device, or uninstalling its agent remotely, resolves the device's own findings with the reason "Device removed from Revo": nothing can check that device again, and a report it sent before removal never reopens them.
• Accepted risks. If the problem behind an accepted risk goes away, the finding is resolved ("Fixed while the risk was accepted"). If it's ever worse than the severity you accepted it at (for example a Windows version whose paid Extended Security Updates ended), it reopens with the reason, because nobody accepted the worse risk. This applies to vulnerability findings too.
• False positives stay. A false positive is your verdict on the check, so later runs never change it.
• Reopen. If the problem comes back, the finding reopens, the regression shows in Change history, and the finding.reopened webhook fires.
• Errors never resolve. A check that errored, timed out or was skipped resolves nothing; it shows as a coverage gap.
• Dark web findings don't auto-resolve. Leaked data stays leaked, so close them once handled.

Out-of-support operating systems

"Runs a Windows release that no longer gets security updates" means Microsoft has stopped releasing updates for that version, so installing updates won't clear it, however up to date the device is. Upgrade the device to the current version instead: on the device page, More actions → Upgrade Windows… (or the Upgrade Windows button on the issue), or approve a Windows version in the customer's patch policy (see Windows upgrades). The finding resolves itself once the device reports the new version. A Windows 10 device that can't run Windows 11 can get paid Extended Security Updates (ESU) on 22H2: accept the risk on its finding with the ESU reference.

Sharing with the customer

Turn off Show to customer on a finding to keep it out of the portal and client reports. Related findings on the same host are hidden too. See Customer portal.

Ideal state

Findings for a control left out of the customer's ideal state are hidden from the list by default. Show N outside the ideal state brings them back, marked Outside ideal state. They stay open but don't count towards the score, compliance or reports.

Alerts are different

Findings are lasting conditions. Things that just happened (malware detected, a new Global Administrator) are alerts, with their own queue. See Alerts.