01 / FINDING CONTINUITY
Build on the previous assessment.
Supported detections can match an existing finding identity. A recognized recurrence updates last-seen information and can add available evidence instead of creating a disconnected duplicate.
FINDING MEMORY
Ares retains recognized finding identity across operations. Repeated observations can update the existing record, helping your team distinguish first discovery from persistent exposure.
Indicator
What it tells your team
How to use it
New
A finding has been newly recorded in Ares. First-seen information provides discovery context.
Investigate the evidence. The live New flag is not an immutable count of findings new in a selected operation.
Recurring
A supported detection has matched a known finding.
Review last-seen information and available evidence for persistence.
Regression
A finding marked fixed, pending verification, or verified has been detected again.
Revisit the remediation decision. The flag calls for review, not automatic status reopening.
Matching depends on supported finding identity and normalization. A materially changed location or identity can create a different record; not every similar-looking vulnerability is guaranteed to merge.
TRACKING CAPABILITIES
Connect ownership and remediation decisions with repeat observations, relevant operation records, and evidence from reassessment.
REMEDIATION STATUS
Keep status, ownership, reasoning, and supporting evidence together. Supported tracker handoff helps connect the finding with engineering work.
Status
What your team is recording
Open
The finding remains in the working queue.
In progress
Remediation work is underway.
Fixed, pending verification
A fix has been claimed and still needs confirmation.
Verified
Remediation has been recorded as verified.
Accepted risk
The exposure is retained as an explicit, understood decision.
False positive
The observation has been judged not to represent the reported vulnerability.
STATUS CHANGE ≠ APPLICATION CHANGE
Changing a status does not perform an exploit retest or prove a fix. Review the affected behavior under suitable assessment conditions before recording verified remediation.
COMPARE RUNS
Select two distinct operations for the same target. Compare runs focuses on endpoint inventories, not a complete vulnerability-by-vulnerability report delta.
Result
Observation set relationship
What it does not prove
Discovered
Present in the later operation; absent from the earlier observation set.
That the endpoint was newly deployed or newly vulnerable.
Lost
Present in the earlier operation; absent from the later observation set.
That it was retired or that its vulnerabilities were fixed.
Persisted
Observed in both operations.
That every property or security behavior is unchanged.
Use canonical comparison to group identifier variants into routes, or raw comparison when specific paths matter. Export the selected Discovered, Lost, or Persisted view as CSV.
The endpoint view does not provide a full report-to-report vulnerability comparison with automatic new, still-open, and fixed tallies.
ILLUSTRATIVE OBSERVATION SETS
This schematic uses fictional route labels to explain endpoint comparison. It is not a product screenshot, customer result, or vulnerability count.
EARLIER OPERATION
GET /account
GET /legacy
Observed at the earlier assessment.
LATER OPERATION
GET /account
GET /profile
Observed at the later assessment.
COMPARISON
Persisted: GET /account
Lost: GET /legacy
Discovered: GET /profile
These labels compare observations, not remediation.
A lost route could reflect removal, changed access, agent reachability, different depth, or an incomplete observation. Investigate before drawing a remediation conclusion.
REASSESS THE FIX
Eligible reports offer Re-run through normal launch checks. Current target settings, repository branch, or attached mobile build can affect the new operation.
Check
Why it matters
Correct target and build
The new operation must assess the application version containing the intended fix.
Network reach
A target or segment that cannot be reached cannot supply evidence about the affected behavior.
Authentication
A lost session or different identity can hide the functionality being checked.
Relevant coverage
Confirm the campaign exercised the affected workflow rather than simply completing.
Supporting evidence
Interpret the new result alongside the original finding and operation context.
A missing finding can reflect remediation, but it can also reflect different access or coverage. Ares does not automatically mark every absent finding fixed.
EVIDENCE AND CONTEXT
Progress, a claimed fix, and verified remediation are different milestones. Interpret the outcome in the context of what the reassessment actually reached.
Use schedules for eligible targets alongside on-demand re-runs after important fixes. Recurring execution creates another observation, not automatic remediation verification.
FREQUENTLY ASKED QUESTIONS
Explain the difference behind the numbers.
Finding totals become meaningful when you understand both the remediation work and what the later assessment actually examined.
TALK TO ASSAIL
Make remediation progress something you can explain.
Track the finding, reassess the fix, and use operation differences to understand the evidence behind the change.
Your environment. Your objectives. A mission built around both.