In Balbix, vulnerability states reflect where each vulnerability stands in the remediation process. These states appear in dashboards, filters, and vulnerability details to help you prioritize efforts, track progress, and evaluate exposure.
Note: In the Balbix UI, these are referred to as “instance states.”
Balbix defines the following vulnerability states:
Active
The vulnerability has been confirmed and poses an active risk. It has not been mitigated or remediated. This includes vulnerabilities with known exploits, critical CVEs, and any weaknesses that remain exposed in your environment.
Mitigated
The vulnerability is still present, but compensating controls have been applied to reduce its risk. This could involve disabling a feature, isolating the system, applying a WAF rule, or any other measure that reduces exploitability without applying a full fix.
Remediated
The vulnerability has been resolved on the affected asset. This typically means a patch or configuration fix has been successfully applied and verified. Vulnerability states are assigned per instance, meaning the same vulnerability can be in different states across different assets, and even across different instances on the same asset.
Unconfirmed
The presence of the vulnerability is suspected but not yet verified. This might be due to incomplete scan data, a mismatch between inventory and patching records, or a newly disclosed issue that has not yet been fully assessed.
Understanding State Distribution
The same vulnerability can exist in different states across your environment. For example:
Remediated on production servers
Mitigated on legacy systems
Active on development environments
Unconfirmed in recently added assets pending scan
Balbix tracks these states per asset, allowing both horizontal views (across all assets for a given CVE) and vertical views (all vulnerabilities on a given asset).
Summary
Balbix uses four vulnerability states to describe the current disposition of each issue:
Active – Confirmed and still exposed
Mitigated – Risk reduced through compensating controls
Remediated – Fully resolved through a fix
Unconfirmed – Not yet verified
See Also: