> For the complete documentation index, see [llms.txt](https://docs.konvu.com/konvu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.konvu.com/konvu/triage-and-remediation/exploitability-assessment/how-assessments-work.md). # How Assessments Work How Konvu evaluates each finding to determine whether it's exploitable in your environment. Konvu evaluates each finding to determine whether the underlying vulnerability is exploitable in your specific environment. This evaluation is called an **assessment**. An assessment combines your source code context, runtime data (if available), and vulnerability intelligence to produce an assessment result with supporting evidence. ## Assessment statuses Every finding has an assessment with one of these statuses:

Status	What it means
Not Started	Assessment hasn't been triggered yet. This typically means source code analysis hasn't run for this repository.
Queued	Assessment is waiting to be processed. It will start automatically.
Ongoing	Konvu is assessing the finding or waiting for additional evidence (e.g., runtime data still collecting).
Success	Assessment is complete. You have a result. See assessment results below.
Failed	Something went wrong during assessment. Check the error details on the finding page.

Most findings move through Not Started, Ongoing, and Success automatically. You don't need to take action unless the status is **Failed** (contact support) or the assessment result is **Needs input** (Konvu has [questions for you](/konvu/triage-and-remediation/exploitability-assessment/answering-konvus-questions.md)). ## Assessment results

When an assessment reaches **Success** status, the result tells you what Konvu determined:

Assessment result	What it means	What to do
Exploitable	Strong evidence that this vulnerability can be exploited in your environment.	Prioritize remediation and Generate a fix pull request
False Positive	Strong evidence that this vulnerability is not exploitable in your environment.	Dismiss it in your scanner.
Needs input	Konvu has questions that could change the assessment.	Answer Konvu's questions.
Inconclusive	Not enough evidence either way, and no actionable questions to ask.	Review the evidence and use your judgment.

*Example: A finding for CVE-2024-47561 in `avro` is assessed as **False Positive** because Konvu determined that the vulnerable deserialization path is not reachable from your application code. The evidence panel shows the specific code paths Konvu analyzed.* ## What triggers a new assessment Assessments run automatically when new evidence becomes available. Common triggers: * **Source code connected.** First assessment runs after Konvu analyzes your repository. * **You answer one of Konvu's questions.** Your input may change the result. See [Answering Konvu's Questions](/konvu/triage-and-remediation/exploitability-assessment/answering-konvus-questions.md). * **You manually re-trigger.** You can request a reassessment from the finding detail page. * **Konvu team re-triggers.** After improvements to Konvu's analysis, the team may re-trigger assessments for better accuracy. ## Previous assessment results When a new assessment starts, the finding's status moves to **Ongoing**, but the previous successful assessment result is preserved. You'll see: > **Status:** Ongoing | **Previous assessment:** False Positive This keeps you oriented while the reassessment runs. Once the new assessment completes, its assessment result replaces the previous one. ## Assessment history Konvu stores every assessment attempt for a finding, creating a history you can review. As new evidence accumulates, assessment results may evolve: | Event | Assessment result | | ----------------------------------- | ----------------------------------------------------------------------------- | | Source code connected | **Inconclusive**: not enough evidence to determine exploitability. | | You answer one of Konvu's questions | **False Positive**: your input confirmed the vulnerable code path isn't used. | Each entry in the history records the evidence available at the time, so you can understand how and why the result changed. ## Next steps * [Answering Konvu's Questions](/konvu/triage-and-remediation/exploitability-assessment/answering-konvus-questions.md): What to do when an assessment needs your input. * [Reading an Assessment](/konvu/triage-and-remediation/exploitability-assessment/reading-an-assessment.md): Understanding the evidence behind each assessment result. * [Reviewing Assessments](/konvu/triage-and-remediation/exploitability-assessment/reviewing-assessments.md): Evaluating results and providing feedback. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.konvu.com/konvu/triage-and-remediation/exploitability-assessment/how-assessments-work.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.