Verification is an important step in the review process as it removes uncertainty, false positives, and finds the most important vulnerabilities to fix, such as the ones that could be used to compromise an environment.
Verification happens at the instance level rather than the finding level. Instances are considered verified when data that proves the existence of the vulnerability is uploaded or added to Resolve. Verification items can include screenshots, terminal output, or user credentials to prove the validity of an exploit or the presence of a genuine vulnerability. You can upload the data as a file or add text through the rich text editor in the workspace. Some instances in a finding might have verification items already included that were captured by the tool or scanner.
Validation
After findings have been reviewed and published to Track, developers or other team members are assigned to fix the vulnerabilities. Depending on your security needs, you might need to validate that the vulnerabilities have been fixed. This workflow is similar to reviewing and verifying instances belonging to new findings. In the case of validation, findings that are shown to have been remediated are updated to a state of remediated.