A good vulnerability tool records each exception with an owner, a reason, an expiry date and an approver, and it brings the finding back when the exception lapses. Check this early. Exceptions that never expire are how known issues quietly become permanent.
Why this belongs in an evaluation
Some findings cannot be fixed this quarter: a vendor has not shipped a patch, or a migration is planned. Accepting that risk is legitimate when it is explicit. Most tools can suppress a finding. Fewer manage the lifecycle of the decision.
Required fields
Who accepted the risk, and are they senior enough under your policy? Why? What compensating control exists? When does it expire? A form missing any of these produces entries that auditors will question.
Expiry and resurfacing
Test what happens on the expiry date. The finding should return to the active list and notify the owner. Also test what happens when the underlying data changes, for example when the issue is later added to a known exploitation list. A suppression should not hide new evidence.
Approval flow
Can a developer request an exception and a security lead approve it, with both steps logged? Can the approver see the context they need without opening three tools?
Reporting
Ask for a report of open exceptions by age, owner and severity. You will need it for audit evidence and for your own hygiene reviews.
Scope of suppression
Check whether a suppression applies to one asset or everywhere. Overbroad suppressions are a common cause of missed findings after a refactor.
Portability
Exceptions are institutional memory. Confirm they export with reasons and dates, so a future migration does not wipe them.
Finally, run a dry audit. Ask a colleague to pick three accepted risks and trace each from request to approval to review date using only the tool. If they need to ask someone, an auditor will need to as well.
Where Safeguard fits
Safeguard covers SBOM and dependency scanning, reachability analysis, policies and gates, and fix pull requests that stay off until you turn them on. You can try a free scan on a repository before you commit to anything.
Try it yourself
Look at how status values are handled on a finding and ask where an accepted risk with an expiry would sit in this view.
Click through it at your own pace, or open it full screen.
Quick check
How long should an exception last?
Set it by severity and policy, then review on expiry. Shorter for higher risk.
Can an exception be silent?
It should not be. Owners should be notified at creation and at expiry.
Last reviewed: 19 October 2026.
