Vulnerability acceptance

Last updated: Oct 27, 2026

---

The Acceptance section in Policies shows the weaknesses that your team requested to accept permanently and temporarily. When you accept vulnerabilities, you accept their risks. The policies approved in this section apply to the reports of all the groups in your organization.

The Security gates thresholds (Days maximum, Acceptances maximum, and Severity range) apply only to the temporary acceptance of each vulnerability. They do not limit the organization-level policies for weakness types that this page describes.

Accept vulnerabilities permanently

The first table in Acceptance lists the weaknesses that your team suggested for permanent acceptance. It also shows the request status ("Approved," "Rejected," "Requested," or "Inactive"), the request date, and the classification tags that the requester added.

Organization Managers can see in the Action column the options to manage permanent acceptance.

Submit a weakness to accept

All team members can make the approval request, but only Organization Managers can approve or reject it. To add a weakness, follow these steps:

1. Click the Add weakness button. In the pop-up window, select the weakness that you want to submit for acceptance.

   

   If a person made the request before, the weakness shows as unavailable, with the request status.

   

2. If you want, add one or more tags for classification.

3. Click the Request button to submit the request.

   

   When you click the Request button, the weakness appears in the table with "Requested" in the Request status column.

Approve and reject acceptance requests

The Action column shows options to manage acceptance requests. Requests with the "Requested" status show the Pending approval button. Manage them as follows:

• Approve: You approve the request. The platform accepts each vulnerability that matches the type or type-tag combination, with no more approvals. This changes the request status from "Requested" to "Approved".
• Reject: You reject the request. This changes its status to "Rejected".

Reactivate and deactivate the acceptance policy

For requests with the "Approved," "Rejected" or "Inactive" status, the Action column shows the Manage button. Manage these requests as follows:

• Click Request to activate acceptance again.

  

  You must confirm the action. This changes the policy status from "Rejected" or "Inactive" to "Approved".

  

• Click Deactivate to stop the acceptance of the weakness.

  

  When you click the button, a pop-up window asks you to confirm. When you click Confirm, the status of this policy changes from "Approved" to "Inactive".

  

Add tags to classify vulnerabilities for acceptance

When submitting a weakness in Acceptance, you can add one or more tags to classify it. These tags help you find information quickly in subsequent searches. They also let you analyze information with categories that are important for your team.

For these analyses, Fluid Attacks offers the analytics Tags by groups and Weaknesses by tags.

Accept vulnerabilities temporarily

The second table in Acceptance shows the weaknesses that your team suggested for temporary acceptance. It also shows the related request status, date and tags. Organization Managers have many options to manage requests.

You can create a temporary acceptance policy for one weakness or for all vulnerability types:

• To submit a request for one weakness, do these steps. You can select only the weaknesses that do not have a request.

  1. Click Add weakness.
  2. Select the weakness.
  3. If you want, add tags.
  4. Click the Request button.
  

  In this window, you may select more than one weakness. Once you select at least one, you are told how many weaknesses are included in your request.

  When you click Request, the policy appears in the table with the "Requested" status. Only a member with the Organization Manager role can approve or reject it.

  When you approve this policy, you authorize the weakness type only for the future. But each new vulnerability that matches it gets its own temporary-acceptance request, which must have a separate approval. A Vulnerability Manager or Group Manager can give this approval for each vulnerability, as Approve or reject vulnerability acceptance treatments describes. This is different from permanent acceptance. For permanent acceptance, an approved organization-level policy is sufficient. The platform accepts new matching vulnerabilities automatically.

  

• To submit a request for all weaknesses, do these steps:

  1. Click the Weakness field.
  2. Select All vulnerability types.
  3. If you want, add tags.
  4. Click the plus button.

  By creating this policy, you acknowledge and temporarily tolerate the risks of all weaknesses detected in your system.

  

Members with the Organization Manager role can manage temporary acceptance in the Action column as follows:

• Pending approval > Approve to start accepting the weakness
• Pending approval > Reject to prevent the acceptance of the weakness
• Manage > Request to activate acceptance of the weakness
• Manage > Deactivate to stop accepting the weakness