Task Management is the layer where a finding stops being a row in a report and becomes somebody’s job. Every task carries a title, a type, a priority, a due date, one or more assignees and a five-stage workflow. A task can be linked to the vulnerability it came from, so the work item always points back to the finding behind it.
The problem
A single scan cycle can produce hundreds of findings. Without a task layer, ownership lives in a spreadsheet that goes stale the day it is created, in a chat thread nobody can search three months later, or in a general-purpose ticket system that knows nothing about the vulnerability behind the ticket.
The costs are familiar.
- Two engineers patch the same host because neither knew the other had picked it up.
- A critical finding sits unowned for two weeks because it was never assigned to a person, only to a team.
- When an auditor asks who remediated a finding, when, and who approved the handover, the answer has to be reconstructed from memory.
- Because status updates are manual, the dashboard says one thing while reality says another.
How it works
- A task is created from a finding, by hand, or by the AI assistant
From a vulnerability detail page, the create-task dialog pre-fills the title, a description containing the finding name, risk level, target IP, port and a direct link back to the vulnerability, and a priority derived from the risk level. Tasks can also be created standalone for work that has no finding behind it, security reviews, penetration tests, report generation, compliance audits, documentation, training and maintenance are built-in task types. The AI assistant can also create and assign tasks conversationally, including batch creation across several people at once, with a due date and SLA hours attached.
- Assignment is multi-owner, with one primary owner
A task holds a list of assignees plus a designated primary assignee. The assignment dialog is a multi-select over your user list. Changes made through that dialog are written to an assignment history table as an explicit assigned or unassigned event, recording which user, who made the change and the exact timestamp. Through the API, an unassigned task can also be claimed by a user directly, and the claim is rejected if someone already owns the task.
- Smart assignment proposes an owner
For unassigned tasks that are linked to a vulnerability, the system scores every active user and proposes the best match with a confidence score and a plain-language reason. The score combines four weighted factors: current workload measured against a capacity of ten open tasks (40%), a role fit score derived from the user’s role and the finding itself (30%), a priority fit score that matches the task priority against the user’s role (20%) and the number of tasks that user has already completed (10%). Users at capacity are excluded from suggestions.
NoteYou accept a suggestion, re-pick the people yourself, or skip it, and skipping removes the suggestion from the current view rather than recording a lasting decision. Nothing is assigned without a human click.
- The task moves through a five-stage workflow
Stages run Detected, Analysis, In Progress, Testing, Completed. Advancing rebuilds the full stage chain cumulatively, so earlier stages stay visible as completed rather than being overwritten: each entry records who started it, who completed it, when, and any notes typed at the transition. Stages can also be reverted when testing sends work back, and the workflow status endpoint reports a progress percentage, completed stage count and whether the task has been escalated.
- Completion closes the loop
Setting a task to completed stamps the completion time and closes the work item. When a linked task is completed through the task update API, that vulnerability is also flipped to resolved in the same transaction. Completing a task from the workflow stage view or from the bulk status bar closes the task itself and leaves the finding’s own state to the vulnerability lifecycle.
LimitationTask creation, assignment and status changes raise in-app notifications for tasks that are linked to a vulnerability; standalone tasks with no linked finding do not raise notifications.
What you can do
Assign one task to several people at once, with a clearly marked primary owner.
See an assignment audit trail per task: each assign and unassign made through the assignment dialog, by whom, when.
Let the system rank candidate owners by live workload, role, priority and track record, then override it.
Advance, revert and annotate a task through five workflow stages with per-stage authorship.
Filter your task list by status and priority, search titles and descriptions, and sort by title, status, priority, due date or creation date.
Select many tasks and bulk-change their status, and bulk-assign or bulk-delete them from the team workflow screen.
Spot overdue work: tasks past their due date and not completed are flagged in the list, with a counter over the tasks currently in view.
Export the task rows currently in view to CSV for reporting or offline review.
Keep estimated versus actual hours, tags, categories and custom fields on the task record, set through the API and shown on the task detail page.
Jump from a task to the vulnerability behind it, and discuss it in that finding’s comment thread.
Who it is for
Get a personal queue instead of a shared inbox: what is mine, what is overdue, what is next.
Receive a task that already contains the host, port and finding detail, so no clarification round-trip is needed.
Use smart assignment and bulk operations to distribute a scan cycle’s output in minutes and watch for pile-ups on one person.
Get an ownership record rather than a status claim.
Get the artifact auditors actually ask for: who was responsible, when it moved, and who closed it.
Why it matters
Closing critical findings quickly is an ownership problem before it is a technical one.
Most of the delay between “we found it” and “we fixed it” is dead time, waiting for someone to decide who does the work. Smart assignment collapses that step into a review-and-confirm, and bulk assignment moves an entire scan cycle’s backlog in a single pass instead of one ticket at a time.
It also removes double work. Because assignment is explicit and visible, two people no longer patch the same host, and nobody has to ask in chat whether a finding is being handled. Because the task and the finding are linked records rather than two separate trackers, your remediation record reflects what people actually did instead of a side list that drifts.
Finally, it makes evidence free. The assignment history and the stage-by-stage workflow record are produced as a by-product of doing the work in the product, so audit questions about accountability and timing are answered by querying the system, not by reconstructing history under deadline pressure.
Works with
- Team workflow, the team-level view where smart assignment suggestions, workload balance and bulk distribution live
- Vulnerability lifecycle, the finding a task is attached to, and the state that task completion can update
- Notifications, the alerts raised when a task linked to a vulnerability is created, assigned or changes status
- Security assistant, creates and assigns tasks conversationally, including batch creation with due dates
Frequently asked questions
Can more than one person own a task?
Yes. A task holds a list of assignees and one primary owner. Adding and removing people is done from a single multi-select dialog, and both additions and removals are recorded in the task’s assignment history.
Can users see tasks that are not theirs?
Non-privileged users only see tasks they created, tasks where they are the primary assignee, or tasks where they appear in the assignee list. This scope applies both to the task list and to opening a task directly by its ID. An out-of-scope request is refused. Admin and manager roles see everything.
What happens to the vulnerability when the task is completed?
If the task is linked to a vulnerability, completing it through the task update API sets that vulnerability to resolved. Completing a task from the workflow view or the bulk status bar closes the task only, and the finding is then closed from the vulnerability lifecycle, for example after a retest confirms the fix. Standalone tasks with no linked finding simply close as tasks.
Where do task comments go?
Discussion happens on the linked vulnerability’s comment thread, shown inline on the task detail page, so conversation stays attached to the finding rather than being split across two places. Tasks created without a vulnerability link do not have a comment thread.
Task Management ships as part of SITEY and runs entirely inside your own infrastructure, task data, assignment history and workflow records never leave your servers. See pricing for the monthly and lifetime options, then deploy it and assign your first scan cycle the same day.