From candidate to defensible finding.

This lifecycle describes how a scanner-provided signal becomes a defensible finding. A detected candidate is first deduplicated and assessed for supporting evidence, then queued for validation and analyst review. Only after it is validated and accepted does it become a reportable finding, with claim status reflecting the current level of confidence and governance. The model also makes room for exception paths when a candidate is rejected as noise, deferred for more evidence, or suppressed with rationale.

The lifecycle does not end at reporting. Findings move into remediation, where work is assigned and retested to confirm the issue is fixed. If the condition persists or recurs, the finding is reopened and re-enters the governed workflow. This structure makes detection accountable, ensures reportability is evidence-based, and keeps remediation tied to verified outcomes.