Understand scan results and findings

  • Release version: Australia
  • Updated June 1, 2026
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Understand scan results and findings

    After running a scan in your ServiceNow instance, you can monitor its progress in real-time, review completed results, and address the findings to resolve issues. This process involves two key steps: viewing the scan results and working with the findings to remediate or manage exceptions.

    Show full answer Show less

    Viewing Scan Results

    You can track active scans or open completed scan records to see details such as status, duration, and batch progress. This visibility helps you understand the scan’s coverage and timing.

    Working with Findings

    Each finding within a scan is evaluated based on two dimensions to guide prioritization and enforcement:

    • Enforcement Level (Level of Finding): Defines the required action and whether exceptions are allowed. The levels are ACT, RECOMMEND, SUGGEST, and REVIEW.
    • Impact to Instance (Risk Rating): A severity score from 1 (minimal) to 10 (critical) within each enforcement level, indicating the business and technical risk of leaving the finding unresolved.

    Enforcement level determines the priority and mandatory nature of remediation, while the impact rating helps prioritize issues within that level.

    Enforcement Levels and Recommended Actions

    • ACT (Critical): Issues that can break functionality or cause security risks; must be fixed before saving records. No exceptions allowed. Overrides require admin rights or disabling the definition.
    • RECOMMEND (High Severity): Issues affecting performance, stability, or security; must be fixed or have an approved exception before saving.
    • SUGGEST (Moderate): Optimization or best practice issues; do not block progress and can be addressed in future development cycles.
    • REVIEW (Low Impact): Informational findings with minimal impact; monitoring and optional fixes in future cycles.

    Important: Enforcement level takes precedence over impact rating in prioritization. For example, an ACT level finding with a low impact rating always has higher priority than a RECOMMEND level finding with a high rating.

    Practical Implications for ServiceNow Customers

    • Use scan results to identify and prioritize issues based on enforcement level and risk impact.
    • Address ACT level findings immediately as they block progress and pose critical risks.
    • Manage exceptions appropriately for RECOMMEND level findings to maintain compliance.
    • Plan remediation of SUGGEST and REVIEW findings according to development cycles without disruption.

    After a scan runs, you can monitor its progress in real-time, review the completed results, and then work with the findings it identifies to resolve issues in your instance.

    Reviewing scan results and acting on findings is a two-phase process.

    1. View scan results: Monitor an active scan or open a completed scan record to see its status, duration, and batch progress. See View scan results for Scan Engine.
    2. Work with findings: Open individual findings from the scan record to understand their enforcement level and impact, then apply fixes or submit exceptions for review. See Work with Scan Engine findings.

    How findings are evaluated

    Every finding in your instance is evaluated along two critical dimensions to help your team prioritize remediation efforts and maintain compliance standards.

    Level of finding (enforcement level)
    The enforcement behavior is determined whether the system blocks an action, issues a warning, or provides informational guidance. Enforcement levels are ACT, RECOMMEND, SUGGEST, and REVIEW. The enforcement level determines the action the system will take and whether exceptions are available.
    Impact to instance (risk rating)
    The business and technical risk of leaving the finding unresolved, rated from 1 (minimal) to 10 (critical) within each enforcement level. Higher values indicate findings that should be addressed first within that level.
    Impact ratings operate independently within each enforcement level and do not create a global 1–10 scale across all levels.

    These two dimensions work together, enforcement level determines what action is required, while impact rating determines the order in which findings should be addressed within that enforcement level. For full details, see Work with Scan Engine findings.

    Enforcement levels and risk impact

    Table 1. Scan Engine finding levels, risk, and enforcement behavior
    Level of finding Impact to instance (typical) Severity description Enforcement behavior / recommended action
    ACT 1–10 Critical issues that can break functionality, cause security vulnerabilities, or block upgrades.
    • The record can not be saved until the code is fixed to meet the requirements in the definition.
    • No exception reason option is available.
    • An override requires admin-level rights or the disabling of the definition.
    RECOMMEND 1-10 High severity issues that may degrade performance, stability, or security. Exceptions are allowed with approval.
    SUGGEST 1-10 Moderate issues, often related to optimization, maintainability, or best practices.
    • Address during future development cycle
    • Does not block progress
    • Prompts to check for a better solution, if one is available.
    REVIEW 1-10 Low impact, informational findings with minimal impact (e.g., unused fields or minor UI inconsistencies). Monitor and optionally fix during future development cycles.
    Important:
    Impact rating applies independently to each enforcement level. An ACT 1 finding is always higher priority than a recommend 10 level finding, even though the numbers appear reversed.

    Enforcement level takes precedence over impact rating in prioritization. The 1–10 scale within each level allows granular severity differentiation while maintaining the enforcement hierarchy.

    Examples

    These two metrics work together to help teams balance enforcement and risk prioritization, ensuring critical issues are addressed first while maintaining development velocity.

    • ACT level finding with impact to instance of 9: Critical and must be fixed immediately before proceeding. No exceptions.
    • SUGGEST level with impact to instance of 8: High-risk but does not block development. Should still be prioritized for remediation.