The Findings Library: Write a Finding Once, Reuse It

The Library is your firm’s own set of reusable findings: the description, remediation, score and references your team has already agreed, written once and brought into every engagement that needs them. It is Library in the navigation, and it is on for every new firm.

Adding to the Library

• From the Library page: New Template opens a new Library entry, with its title, its severity and the fields your firm reuses. With an AI provider connected, Generate all fills whatever is empty from the title.
• From a finding: the Library button on the finding adds it.
• In bulk: tick findings in a findings list and press Add to Library on the bar that appears.
• Automatically: with Add every new finding to the library automatically on (Settings, Findings), every finding you write is added once it is final, which is when you save it or, for a draft, when it is saved or marked as final.

The Library holds one entry per title. Adding a finding whose title it already has, worded differently, asks first whether to replace the entry’s wording, and word for word the same, it says so and changes nothing.

Which fields travel

Settings, Findings decides it. Each field there can be reused from the Library: a reused field is stored on the entry and pulled in when you load it, the description for example, while a field that is not reused stays specific to each engagement, evidence for example. Title and severity always travel, a score travels with the vector it was worked out from, and your custom finding fields have the same choice. A field switched off, or not reused, has no column in the Library either.

Using it on an engagement

• Typing a finding’s title suggests up to five entries whose title or CWE matches; picking one fills the form with the entry’s wording.
• Import from Library, on each phase or on an engagement without phases, lists every entry with a search box; Import adds the entry to that phase as a finding, with its wording, severity, score and vector, and the fields you reuse.

An imported finding is a finding like any other: edit it for this client, and if the new wording is better than the Library’s, add it back. Common penetration test findings is a good list of what is worth writing once, and CVSS 4.0 examples shows scores with their vectors for the same kind of entry.

Switching it off

Library is a module in Settings, Feature Modules, on from the start. Off hides the area for everyone, and the entries are kept for the day you switch it back on; switching off the parts you do not use covers that screen. Clients never see the Library: your database does not let a client login read it.