Titan AI is in beta. Features and behavior may change, and some functionality is still in development. To share feedback or report an issue, complete the support form.
Findings are the foundation of how Titan AI detects, organizes, and communicates security risks. This article presents the core concepts and shows how findings are presented differently to Vendor Risk Management (VRM) teams and Vendors, depending on their goals.
What are Findings?
Findings are detected security weaknesses or vulnerabilities.
- For Vendor Risk Management (VRMs): Findings reflect risks across your vendor ecosystem.
- For Vendors: Findings reflect risks found on your own public-facing assets.
Titan AI continuously scans and monitors all assets using SecurityScorecard's proprietary scanning technology.
Key terminology
We use Findings and Finding Groups to provide a clear, organized structure for managing security risks across your digital footprint.
Findings Group
A collection of individual findings that share the same root cause or finding name (For example, all instances of CVE-2016-xxxx). This allows for collective management and is the default view.Finding
A single instance of a security finding tied to a specific asset (for example, SSL/TLS Service Supports Weak Protocol).
How findings appear to different users
While the underlying data is the same, the display and prioritization of findings are tailored to the unique goals of each user role.
For VRMs: Open Findings
The My Network > Findings page provides a high-level assessment of risks across every monitored vendor and supports early risk detection, prioritization, and more efficient coordination with vendors.
You can use this view to:
Quickly assess the most critical risks affecting your supply chain by sorting by Threat level.
Understand which finding types (for example, vulnerabilities or misconfigurations) appear most frequently.
Click into any Findings Group to see detailed asset-level impact.
Filter by company, last seen, or portfolio to focus on the vendors that matter most.
For Vendors: My Findings (Remediation Focus)
The My Company > Findings page shows all detected findings on your own public-facing assets and helps you prioritize remediation work.
You can use this view to:
Track all findings affecting your organization.
Prioritize by Requestor so the most frequently requested issues surface first.
Filter by Status to see what’s Open, Pending, or Resolved.
Build customer trust by addressing high-impact issues first.
How to navigate findings
Titan AI takes you from a high-level group to granular asset detail in three steps.
Step 1: Start at the findings group level
This is the main list shown to both VRMs and Vendors.
Each row represents one finding group.
A group contains multiple findings that share the same name (e.g., a CVE or a misconfiguration type).
Step 2: Open a findings group
Clicking into a findings group opens the Group Preview panel, which summarizes every finding in that group without listing them individually. A group may contain many findings if the same issue appears across multiple assets.
This panel contains the:
- Finding status breakdown: How many findings in the group are Open, Pending, or Resolved.
- Vendor response breakdown: How many findings have received a response versus no response.
- Remediation breakdown: How many findings have no engagement, an internal request, or an external request.
- Flagging state breakdown: How many findings are flagged versus not flagged.
Select any badge in these sections to filter straight into that subset of findings.
Step 3: View all findings in the group
Select View all findings from the Group Preview panel to see the list of individual Findings within that group, each representing a single detected instance of the issue on a specific asset.
This is where you can perform actions on your findings, such as flag a finding or request remediation.
Step 4: Select a finding to view details
Selecting an individual row opens the Finding Detail panel.
This panel contains the:
- Overview tab: Displays an overview of the finding, along with key fields, a description, and, if available, a recommendation for remediation. You will also see additional data specific to the finding type.
- Activity tab: Shows a detailed timeline of status changes, flagging, vendor responses, and VRM actions.
- Requestors tab: Only visible on the My Company > My Findings page. This shows every customer that has requested or flagged this finding.
- Documents tab: Only visible on the My Company > My Findings page. Appears when a file has been attached to a response on this finding
Finding types
Findings fall into high-level categories to help you quickly understand the nature and potential impact of the identified security issue.
| Type | Definition |
| Vulnerabilities | Known software weaknesses (such as CVEs) that attackers could exploit to gain unauthorized access or disrupt systems. |
| Application Misconfigurations | Errors or unsafe settings in web or cloud applications (e.g., exposed admin panels or missing authentication). |
| DNS Misconfigurations | Issues with a vendor’s DNS records that may expose services to hijacking or cause domain misdirection. |
| Information Leak | Accidental exposure of sensitive information such as credentials or internal data appearing on public sites or repositories. |
| Insecure Endpoints | Open ports or services on a vendor’s network that are accessible without proper encryption or authentication. |
| Out-of-Date Products | Software or platforms running outdated versions that lack the latest security patches. |
| Potential Compromise | Evidence suggesting a vendor system or domain may already be compromised. |
| Typosquatting | Domains registered that closely resemble a vendor’s legitimate domain, which can be used for phishing or impersonation attempts. |