Guides
Guides and research
Plain answers about fixing security findings, meeting remediation deadlines and the evidence behind them.
Updated · Railo
Read
- Pentest findings, fixed before your retest
Who fixes pentest findings, the retest windows providers publish, and what a fixed finding should come back with.
- Overdue vulnerabilities in Drata or Vanta
How the deadlines and tests work, why a longer SLA does not rescue overdue findings, and your options.
- Vulnerability remediation evidence for SOC 2
What CC7.1 and CC8.1 say, the records teams usually keep for each fix, and the gaps that become exceptions.
- We read all 162 automatic fixes. 95 were wrong.
Railo's own test on 11 public repositories: the data, why fixes were wrong, and what we changed.