Finding States & Grades

Every finding in Firmis has a state that represents where it is in the verification lifecycle. States drive your security grade and determine what shows up in reports.

States

State	Meaning	Set By
detected	Found by static rules, not yet verified	firmis scan
confirmed	AI verified as exploitable	firmis scan --deep or firmis triage
dismissed	AI assessed as not exploitable	firmis scan --deep or firmis triage
accepted	Human reviewed and accepted the risk	firmis accept

State Transitions

detected --> confirmed    (deep scan finds it exploitable)
detected --> dismissed    (deep scan finds it not exploitable)
detected --> accepted     (human accepts the risk)
confirmed -> accepted     (human accepts a confirmed risk)
dismissed -> accepted     (human accepts despite dismissal)
accepted --> detected     (acceptance expires or version changes)

How States Are Resolved

When deep scan analyzes a finding:

• CVE findings (osv-* rules) always stay detected regardless of AI analysis. CVEs are verified by the OSV database, not by AI.
• Analyzed and matched: finding becomes confirmed with attack technique and reasoning
• Analyzed and unmatched: finding becomes dismissed
• Not analyzed (skipped or rate-limited): stays detected

Security Grades

After deep scan, Firmis computes a security grade from A (best) to F (worst).

Note

Grades are only computed after a deep scan. Static-only scans report finding counts but no grade.

How Grades Are Computed

The grade calculation excludes:

• Dismissed findings (AI verified as safe)
• Non-CVE detected findings (not yet verified)

The grade includes:

• Confirmed findings (verified exploitable)
• CVE findings (always counted)
• Accepted findings affect a separate “grade without acceptances” metric

Grade Comparison

When accepted risks exist, reports show both:

Grade: B (without accepted risks: C)

This transparency lets teams and auditors see the impact of risk acceptance decisions.

Deep Scan Metadata

Each finding gains additional metadata after deep scan:

Field	Description
state	Current finding state
attack_technique	How the finding could be exploited
reasoning	AI explanation of the assessment
suggestedDisposition	AI recommendation: accept, fix, or investigate
confidence	0-1 score. Higher means more certain.

JSON Output

In JSON reports (firmis scan --json), finding states appear as:

{
  "schema_version": "2.0",
  "scan_mode": "deep",
  "grade": "B",
  "findings": [
    {
      "ruleId": "tool-poisoning-004",
      "state": "confirmed",
      "attack_technique": "Tool description override",
      "reasoning": "The tool description contains instructions that override the agent's system prompt..."
    }
  ]
}

Workflow

The recommended workflow using states:

1. Scan: firmis scan . produces detected findings
2. Verify: firmis scan --deep . promotes findings to confirmed or dismissed
3. Accept: firmis accept lets you accept verified risks with audit trail
4. Monitor: firmis monitor watches for new findings at runtime