# Resolve Vulnerabilities

Vulnerabilities detected via integrated scanners or uploaded manually from a penetration test (pentest) must be resolved within the defined SLA to maintain a compliant posture.

Sprinto distinguishes between vulnerabilities based on their source:

* **Scanner-based vulnerabilities**: Automatically synced and updated by Sprinto.
* **Pentest-based vulnerabilities**: Require manual closure after mitigation.

You can also mark non-relevant issues as special cases if required.

***

### Before You Begin

Ensure that:

* You have administrator access to Sprinto.
* For scanner-based vulnerabilities, the source system is updated with the fix.
* For pentest-reported vulnerabilities, you’ve completed the required mitigation.
* You are familiar with special case handling if a vulnerability cannot be resolved.

***

### Procedure

#### 1. Navigate to Vulnerabilities

1. Log in to the Sprinto admin portal.
2. Go to **Data Library > Vulnerabilities**.
3. Select the appropriate monitoring source from the left-hand menu, or click **Pentest** to view uploaded vulnerabilities.

***

#### 2. Resolve Scanner-based Vulnerabilities

1. Select a vulnerability with status **Due**, **Pending**, or **Failing**.
2. Review its details, including:
   * Resource type
   * Category
   * Severity
   * Due date
   * Assigned owner
3. Remediate the issue directly at the source (e.g. AWS Inspector, GitLab, Snyk).
4. Once the vulnerability is closed at the source, Sprinto automatically syncs the updated status and marks the corresponding check as **Passing**.

***

#### 3. Resolve Pentest-reported Vulnerabilities

1. Go to the **Pentest** tab under Vulnerabilities.
2. Click the **Vulnerabilities** sub-tab.
3. Find the relevant item in **Open** status and take the necessary mitigation action.
4. Once resolved, click **Close** next to the vulnerability.
5. Enter:
   * **Closure date**
   * **Closure reason**
6. Click **Close Vulnerability** to confirm.

***

#### 4. Mark as Special Case (Optional)

If the vulnerability is not relevant or cannot be resolved, mark it as a **Special Case**:

1. Select the open vulnerability from either a scanner or pentest source.
2. Click **Mark as Special Case**.
3. Enter a justification in the remarks field.
4. (Optional) Upload a supporting document.
5. Choose one of the following:
   * **Valid forever**
   * **Let me select an expiry date**
6. Click **Mark as Special Case** to save.

This action marks the check as **Passing**, but the entry remains visible in compliance logs.

***

### Result

* Scanner-based vulnerabilities are auto-synced and marked **Resolved** upon source remediation.
* Pentest vulnerabilities are manually closed in Sprinto after mitigation.
* Special case vulnerabilities are excluded from failure checks but retained for audit.