> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/triage.md).

# Triage

## Overview

Finding a potential vulnerability is the easy part — deciding whether it's real, how urgent it is, and who should deal with it is where most security programs drown. Triage is what Nullify does between detection and remediation, and it's applied to **every** finding, from every capability: code review, dependency and container analysis, secrets detection, cloud audits, supply-chain posture, bug hunts, and pentests.

The goal is simple: the things in front of you should be the things that actually matter, ranked in the order you should act on them.

## What triage evaluates

For each finding, Nullify weighs:

* **Reachability** — is the vulnerable code or dependency actually reached by your application, and is the asset reachable from the internet? A vulnerable package your code never calls, or a misconfiguration on an internal-only asset, is not the same risk as one on an internet-facing path.
* **Exploitability** — can this actually be exploited, and has Nullify proven it? A pentest finding backed by a reproduced exploit outranks a theoretical one; a leaked credential that's still live outranks one that's already been rotated.
* **Business context** — what does the affected service do, what data flows through it, and how critical is it? Nullify draws this from the [Context Engine](/capabilities/context-engine.md) and the organizational context you provide.
* **Confidence** — how sure is Nullify that this is a true positive? Low-confidence pattern matches are screened out rather than dumped on you.

Triage combines Nullify's reasoning with deterministic rules, so the same finding lands in the same place every time.

## Severity and priority

Nullify tracks two related but distinct signals:

* **Severity** — how bad the issue is in the abstract (roughly, how much damage it could do).
* **Priority** — how urgently *you* should act on it, once reachability, exploitability, and business context are folded in. Priority is the ranking that drives ticketing thresholds, SLAs, and the order work is surfaced. Nullify's priority labels run from `URGENT` and `IMPORTANT` down through `MEDIUM`, `LOW`, `INFORMATIONAL`, and `NEGLIGIBLE`.

A critical-severity CVE in a dependency your code never loads can carry a lower priority than a high-severity issue on an internet-facing service — because priority reflects real-world risk, not just the raw score.

## False-positive screening

Before a finding ever reaches you, Nullify screens out the noise: unreachable code paths, test fixtures and example credentials, benign configuration variation, and duplicate reports of the same underlying issue. What survives is meant to be worth a human's attention.

## Re-triage

Triage isn't a one-time verdict. When something changes — new code lands, a dependency is upgraded, a fix merges, or new threat intelligence arrives — Nullify re-triages the affected findings and updates their priority. A finding that becomes reachable is escalated; one that's been fixed or is no longer exploitable is de-prioritized or resolved.

## Your decisions stick

When you make a triage decision — allowlist a finding, accept a risk, mark a false positive, or override a severity — Nullify remembers it. Those decisions persist across future scans and feed back into how Nullify triages similar findings, so you don't re-litigate the same call every time a scan runs. See the per-capability configuration pages for how to allowlist and adjust findings.

## Where triaged findings go

Triaged findings flow into [Security Program Management](/capabilities/program-management.md), which sequences and assigns the work, and into [Remediations](/capabilities/remediations.md), which drafts the fixes. When Nullify needs a human judgment call it can't make alone — an escalation decision, a clarifying question, an ownership mapping — it raises an [action item](/capabilities/working-with-nullify.md).