Findings

Findings is a top-level item in the sidebar at /findings. It surfaces security posture issues across your apps, user accounts, OAuth grants, and browser extensions. Each finding has a risk level, context, and a clear path to remediation.

​

The Findings page

​

Group-by

The first thing to configure is how findings are grouped. Use the Group By selector in the top bar: When grouped, rows are expandable — click any group to see individual finding instances.

​

Filters

Narrow findings using the filter panel (click the filter icon): Result

• Failed
• Passed
• Unknown

Severity

• High
• Medium
• Low

Status (multi-select)

• Open
• In Progress
• Verifying
• Resolved
• Reopened
• Muted
• Accepted

Risk category (multi-select)

• Identity
• Configuration
• Integration
• Data
• Supply chain
• Governance

Search — free text across finding names and descriptions.

​

Table columns

​

Export

Click Export CSV to download the current filtered view.

​

What findings check

Findings cover several risk categories. Examples of what gets flagged: Identity

• User accessing an app without SSO enforcement
• Deprovisioned directory user with active app access
• No MFA on a high-risk application

Integration

• High-risk OAuth grant (broad scopes + stale)
• OAuth grant from an app with a known breach
• Unused OAuth grant (90+ days with no activity)

Supply chain

• Browser extension with <all_urls> host permission
• Sideloaded extension (not from Chrome Web Store)
• Extension with permission escalation since last scan
• Extension denied by policy still active on a device

Configuration

• App in use with no owner assigned
• App with active spend but no contract on file

Governance

• Shadow IT app with multiple active users and no approval decision
• Access request open with no action for 7+ days

​

Working with findings

​

Opening a finding detail

Click any finding row to open the detail panel on the right side of the page. The panel shows:

• Full description and why it matters
• Affected resource (app, user, grant, or extension) with a direct link
• Evidence — the specific data that triggered the finding
• Remediation steps

​

Updating status

From the detail panel, update the finding’s workflow status: Open → In Progress — mark it as being worked on In Progress → Resolved — mark it as fixed; Porcia will verify on the next check run Open → Muted — suppress without full resolution (e.g. known false positive) Open → Accepted — accept the risk with a mandatory justification note

​

Running checks manually

From the findings page empty state or via the Run security checks button, you can trigger an immediate re-evaluation instead of waiting for the next scheduled run.

​

Finding lifecycle

Findings are created by the check engine on a schedule. If a finding is resolved and the underlying issue recurs (e.g. the same OAuth grant gets re-authorized), the finding reopens automatically with a Reopened status. Accepted-risk findings have a review date — they reopen automatically when the review date passes so the decision gets reconsidered periodically.

​

Notifications

Set up a Rule to get notified when new findings are created matching specific criteria — for example, alert the security team in Slack whenever a new Critical finding is opened.

​

Next steps