Change Pentest Finding Severity
Change the severity of an Aikido Pentest finding when you think the assigned level is not adequate.
Change the severity of an open pentest finding when you think the level Aikido assigned is not adequate, whether it is too high or too low. Aikido reviews your reason and applies the change when the reason fits the finding.
#Prerequisites
You can change a finding's severity with these permissions. See Setting Roles and Permissions.
- Admins can change pentest severity.
- Default users need both Can change issue severity and Can manage pentests and AI code analyses.
- The finding must be open.
#Change the severity
#Open the finding
Open the pentest issue and, in Subissues, open the actions menu on the finding. Select Adjust severity.
#Choose a severity and explain why
In Adjust issue severity, select the new severity under New severity: Critical, High, Medium, or Low.
In Reason for adjustment, explain why the severity should change. Describe the business context, the intended behavior, or the impact the current severity misses. For example, the endpoint is internal-only.
Click Confirm.
#Review the decision
Aikido reviews the reason against the finding.
- When Aikido approves the change, the finding uses the new severity. Aikido recalculates the issue group's severity and resets the finding's service level agreement (SLA) date. Reports you download after the change use the new severity.
- When Aikido denies the change, the dialog stays open and shows Severity change denied with an explanation. The severity stays as it is. Revise the reason and click Confirm again.
#How Aikido reviews the reason
Aikido approves a reason that explains why the finding's impact is higher or lower than the current severity. That includes intended behavior, extra business context, or a concrete path to more impact.
Aikido denies a reason that only asks for a different severity, such as "change it" or "not important", and a reason that skips a serious impact already shown on the finding.