Scanners use suppress, ignore, dismiss, snooze and mute loosely, and meanings vary by tool. As a rule: suppress and ignore hide a finding by rule, dismiss closes one alert with a reason, snooze hides it until a date, and mute hides notifications only. Always read what your tool does with the finding itself.
Why the vocabulary matters
Teams argue past each other when one person says "ignore" and means a permanent hide, while another hears a temporary pause. Auditors ask for your exceptions and get a different answer from each tool. Agreeing on terms inside your team costs an hour and saves months of confusion.
Working definitions
| Word | Typical meaning | Hides the finding? | Should it expire? |
|---|---|---|---|
| Suppress | A rule that stops a finding being reported or counted | Yes | Yes |
| Ignore | Often the same as suppress, sometimes permanent by default | Yes | Yes |
| Dismiss | Close a single alert, usually with a chosen reason | Yes, that alert | Depends on reason |
| Snooze | Hide until a date or event, then return | Temporarily | Built in |
| Mute | Stop notifications, keep the finding in the list | No | Optional |
| Accept risk | A recorded decision to live with it | Often yes | Yes |
| Not affected | A statement the product is not exposed | Yes | Review on change |
These are patterns, not standards. Check your tool's documentation.
Two questions that cut through it
- Is the finding still counted? If it disappears from totals and gates, someone must own the decision.
- Does it come back? If not, you have a permanent hide. Add an end date or a review rule.
How the terms map to decisions
- A false positive is a statement about the scanner. Dismiss or suppress with a reason of not present, not reachable or data error.
- A deferral is a statement about your schedule. Snooze with a short date and an owner.
- An accepted risk is a statement about your appetite. Record approver, scope and expiry.
- A not affected statement is about the product, and it can be shared with customers in a machine readable format. The OpenVEX specification defines it as one of four statuses alongside affected, fixed and under investigation.
Our posts on auto dismiss and snooze and risk acceptance versus not affected go deeper on each.
Set house words
Pick one term for hiding by rule, one for closing an alert, and one for pausing. Put them at the top of your suppression policy, and use them in tickets and dashboards. When you read a vendor's docs, translate their terms into yours.
Try it yourself
Click through it at your own pace, or open it full screen. Look at the status options on a finding and compare them with the glossary above.
Quick check
Is muting the same as suppressing?
No. Muting usually silences notifications while the finding stays counted. Suppressing removes it from reports and gates.
Which of these should never be permanent?
Snooze by design returns. Suppress, ignore and accept risk should all carry an end date.
Sources
Last reviewed: 19 October 2026.
