Closing the ticket starts the check. It is never the check.
Only one of these is closed.
The root cause is gone from the environment.
A control broke the route. The root is still there. Open, and the record says so.
Often the right call. Unizo drafts it.
Nothing reaches it today. The root is still there. It comes back when a route does.
Block the route today. Remove the cause when you can.
Unizo drafts both and drives either. Only one closes the exposure.
What you can show someone else.
- Verdict
- blocked by permission boundary
- Root
- api key in mcp config
- Re-derived
- present
- Control
- PB-restrict
- Provider
- AWS
- State
- open · route blocked
- Root
- api key in mcp config
- Re-derived
- not present
- State
- closed
What has to be gone.
| Exposure type | What has to be gone |
|---|---|
| Vulnerability on a host or workload | The finding on the asset |
| Cloud misconfiguration | The misconfigured setting |
| Identity and access | The over-privileged grant, not the principal or the resource |
| Code to runtime | The vulnerable artifact still deployed, not the repository commit |
| AI asset on a path | The embedded credential |
Independently re-derived, with effective-access verification where the credential terminates at a control plane Unizo can simulate against.
Does closing the ticket ever close the exposure?
No. It starts the check.
Does a compensating control close it?
No, and Unizo drafts one anyway when it is the right move. The exposure stays open and the record says so.
What if the cause comes back?
Closure is a checked state at a recorded time. When a root cause reappears, Unizo reopens the Exposure.
Do we need our scanner replaced?
No. The check runs against the sources that reported it.
Bring us one you have already closed.
We will check it against your environment and show you what we find.