Understand scan results and findings
After a scan runs, you can monitor its progress in real-time, review the completed results, and then work with the findings it identifies to resolve issues in your instance.
Reviewing scan results and acting on findings is a two-phase process.
- View scan results: Monitor an active scan or open a completed scan record to see its status, duration, and batch progress. See View scan results for Scan Engine.
- Work with findings: Open individual findings from the scan record to understand their enforcement level and impact, then apply fixes or submit exceptions for review. See Work with Scan Engine findings.
How findings are evaluated
Every finding in your instance is evaluated along two critical dimensions to help your team prioritize remediation efforts and maintain compliance standards.
Level of finding (enforcement level)
The enforcement behavior is determined whether the system blocks an action, issues a warning, or provides informational guidance. Enforcement levels are ACT, RECOMMEND, SUGGEST, and REVIEW. The enforcement level determines the action the system will take and whether exceptions are available.
Impact to instance (risk rating)
The business and technical risk of leaving the finding unresolved, rated from 1 (minimal) to 10 (critical) within each enforcement level. Higher values indicate findings that should be addressed first within that level.
Impact ratings operate independently within each enforcement level and do not create a global 1–10 scale across all levels.
These two dimensions work together, enforcement level determines what action is required, while impact rating determines the order in which findings should be addressed within that enforcement level. For full details, see Work with Scan Engine findings.
Enforcement levels and risk impact
| Level of finding | Impact to instance \(typical\) | Severity description | Enforcement behavior / recommended action |
|---|---|---|---|
| ACT | 1–10 | Critical issues that can break functionality, cause security vulnerabilities, or block upgrades. | - The record can not be saved until the code is fixed to meet the requirements in the definition. - No exception reason option is available. - An override requires admin-level rights or the disabling of the definition. |
| RECOMMEND | 1-10 | High severity issues that may degrade performance, stability, or security. Exceptions are allowed with approval. | - The record can not be saved until the issue is resolved or and exception reason is provided formal approval. - For more information, refer to Submit exceptions for Scan Engine findings. |
| SUGGEST | 1-10 | Moderate issues, often related to optimization, maintainability, or best practices. | - Address during future development cycle - Does not block progress - Prompts to check for a better solution, if one is available. |
| REVIEW | 1-10 | Low impact, informational findings with minimal impact \(e.g., unused fields or minor UI inconsistencies\). | Monitor and optionally fix during future development cycles. |
Important: Impact rating applies independently to each enforcement level. An ACT 1 finding is always higher priority than a recommend 10 level finding, even though the numbers appear reversed.
Enforcement level takes precedence over impact rating in prioritization. The 1–10 scale within each level allows granular severity differentiation while maintaining the enforcement hierarchy.
Examples
These two metrics work together to help teams balance enforcement and risk prioritization, ensuring critical issues are addressed first while maintaining development velocity.
- ACT level finding with impact to instance of 9: Critical and must be fixed immediately before proceeding. No exceptions.
- SUGGEST level with impact to instance of 8: High-risk but does not block development. Should still be prioritized for remediation.
Related topics