Delivery boards

Overview

Every confirmed finding PENOPS produces becomes a card. Cards move through three boards: security analysts decide how to treat each risk, engineers fix what needs fixing, and everything you accept, transfer or avoid is kept on record.

You find the boards in the sidebar under Operations. Admins set the rules that govern the flow under Manage > Workflow Policy (see Treatments and workflow policy).

Boards and lanes

Each board is split into lanes. A card's lane is its status.

The card panel sometimes calls the triage lane In Review, and the Reopen dialog calls it Triage. All three names mean the same lane.

Related findings can appear as one stack on the board, for example one cloud check failing across several regions, several CVEs in one component on one host, or one secret found in several places. Each finding in a stack is still its own card with its own severity and status.

Triage a new finding

1. Go to Operations > Risk Treatment and click a card in Intake to open its panel.
2. Drag the card to Triage & Decide, or use the Status picker in the panel header.
3. Adjust Severity if needed. The severity badge in the header is a picker. The panel also shows the scanner's original severity next to it.
4. Open Risk Treatment in the properties row and choose Mitigate, Transfer, Avoid or Accept. From Triage & Decide, the card moves to Treated automatically.
5. Write a Business Justification in the editor that opens, and press ⌘↵ to save. For Accept this is required: the treatment is only saved once you save a non-empty justification.
6. Click the handoff button in the header: Push to Remediation → for treatments that go to delivery, or Move to Risk Register → for the others.

Which treatments go to delivery is set in the workflow policy. See Treatments and workflow policy.

Pick up and work a finding

1. Go to Operations > Remediation Delivery. Cards waiting for an owner are in Ready to Pull.
2. Hover a card and click Pick up, or drag it into To Do. In the owner menu you can pick it up yourself, or assign it to a colleague under Assign to if you have the Assignment permission.
3. Drag the card from To Do to In Progress when you start.
4. Work through the checklist under Remediation, ticking each step as you go. You can add a step (Add a remediation step…), double-click a step to edit it, or remove it.
5. When every step is ticked, click Validate fix. PENOPS re-tests the finding. See Fix validation.
6. Drag the card to Done. Optionally click Push to Risk Register → to keep tracking the residual risk after delivery.

To pick up several cards at once, tick them in Ready to Pull, click Pick up in the column header, then confirm in the Pick up <n> findings dialog. Each card is checked on its own, and any that are skipped are listed with the reason. If some were refused because of the WIP limit, Retry with override picks them up anyway and records the override. You can pick up at most 100 cards at a time.

To hand a card back, choose Unassign · Drop ticket on a card you own in To Do or In Progress. It returns to Ready to Pull. Taking a card off someone else needs the Assignment permission.

The card and its panel

Each card has an id such as ID001. Click a card to open its panel. The panel's link opens the same board with that card selected, so you can share it.

Badges on a card

Panel header

The header shows how long the finding has been open (Open <n> days or Closed after <n> days), its SLA, and the properties row: owner, Status, Severity and Risk Treatment. Actions here include Pick up, Assign…, Reopen…, the handoff button and the suppress icon.

Panel sections

• Background and Evidence: what PENOPS found and how.
• Business Justification: why you chose the treatment. Supports Markdown.
• Remediation: a checklist of fix steps generated by PENOPS from the finding's evidence, plus the fix validation strip. When a finding has no steps, guidance is shown as text.
• Subtasks: smaller tasks, with @mentions (Add a task… @ to mention).
• Tabs Discussion (comments with @mentions and Markdown, ⌘↵ to post), Linked Work Items, Audit Trail and History.
• Sidebar: the asset context for the finding type, links to its Engagement and Exposure, Vulnerability Intel (score, CVE, CWE and more), Compliance Impact, Tags and Timeline.

In Linked Work Items you can link another finding as Affected By, Predecessor or Successor. The other card shows the reverse link (Affects) automatically. In Compliance Impact, click + Add framework and enter a control reference such as SOC 2 · CC6.1 (up to 25 characters).

My Queue, All Findings and the Risk Register

My Queue shows your own To Do and In Progress cards, worst severity first, alongside Critical & Unassigned, Approaching SLA, Zero Trust Violations (only when there are any) and Incoming (cards awaiting triage).

All Findings shows every board you can read on one page.

The Risk Register is a sortable table with Engagement, Owner, Severity, Finding, Risk Treatment, Suppressed, Justification and Updated. A missing justification shows as Required.

Filter, group and export

• Filter by Severity, Source, Engagement, Assigned to, Risk Treatment and Tags. Use the gear (Configure filters) to add Status, Suppressed and Compliance.
• Filters are kept in the URL and carry over between board pages, so a filtered link can be shared.
• The overflow menu offers Group by (Severity, Product, Risk Treatment or Assignee), Toggle density and Export CSV.
• Each column loads 50 cards. Click Load more for the next set.

Good to know

• You cannot drag a card between boards. Use the handoff buttons, pickup and Reopen….
• Export CSV exports only the cards currently loaded on screen, and identifies cards and assignees by internal identifiers rather than ID001-style ids and names. Click Load more first if you need more cards.
• If someone else changes a card while you are working on it, PENOPS shows This card was updated - refreshed and reloads it. Repeat your change if it still applies.
• Comments can be up to 10,000 characters and subtask titles up to 500.