Findings

Findings is a top-level item in the sidebar. It surfaces security posture issues across your apps, user accounts, OAuth grants, and browser extensions. Each finding has a risk level, context, and a clear path to remediation.

​

The Findings page

​

Group-by

The first thing to configure is how findings are grouped. Use the Group By selector in the top bar: When grouped, rows are expandable — click any group to see individual finding instances.

​

Filters

Narrow findings using the filter panel (click the filter icon): Result

• Failed
• Passed
• Unknown

Severity

• Critical
• High
• Medium
• Low

Status (multi-select)

• Open
• In Progress
• Verifying
• Resolved
• Reopened
• Muted
• Accepted

Risk category (multi-select)

• Identity
• Configuration
• Integration
• Data
• Supply chain
• Governance
• Threat

Search — free text across finding names and descriptions.

​

Table columns

​

Export

Click Export CSV to download the current filtered view.

​

What findings check

Findings cover several risk categories. Examples of what gets flagged: Identity

• User accessing an app without SSO enforcement
• Deprovisioned directory user with active app access
• No MFA on a high-risk application

Integration

• High-risk OAuth grant (broad scopes + stale)
• OAuth grant from an app with a known breach
• Unused OAuth grant (90+ days with no activity)

Supply chain

• Browser extension with <all_urls> host permission
• Sideloaded extension (not from Chrome Web Store)
• Extension with permission escalation since last scan
• Extension denied by policy still active on a device

Configuration

• App in use with no owner assigned
• App with active spend but no contract on file

Governance

• Shadow App with multiple active users and no approval decision
• Access request open with no action for 7+ days

​

Working with findings

​

Opening a finding detail

Click any finding row to open the detail panel on the right side of the page. The panel shows:

• Full description and why it matters
• Affected resource (app, user, grant, or extension) with a direct link
• Evidence — the specific data that triggered the finding
• Remediation steps

​

Updating status

From the detail panel, update the finding’s workflow status: Open → In Progress — mark it as being worked on In Progress → Resolved — mark it as fixed; Porcia will verify on the next check run Open → Muted — suppress without full resolution (e.g. known false positive) Accept the risk — request a risk exception with a justification and a duration. Once approved, the finding stays accepted until the exception expires.

​

Running checks manually

From the findings page empty state or via the Run security checks button, you can trigger an immediate re-evaluation instead of waiting for the next scheduled run.

​

Finding lifecycle

Findings are created by the check engine on a schedule. If a finding is resolved and the underlying issue recurs (e.g. the same OAuth grant gets re-authorized), the finding reopens automatically with a Reopened status. Risk exceptions have a set duration, so accepted risks come back up for review instead of being accepted forever.

​

Notifications

Use Rules to alert the right people by email or Slack when supported events happen, such as a new risky OAuth grant or a newly discovered app.

​

Next steps