---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Modify the risk rating for a finding or remediation task

# Modify the risk rating for a finding or remediation task {#ariaid-title1}

Release version: Australia  
Updated September 30, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Change the risk rating for a host vulnerable item, application vulnerable item, container vulnerable item, or remediation task in the Security Exposure Management Workspace.

## Before you begin

Role required:

* Host vulnerable items (VITs): sn_vul.vulnerability_analyst, sn_vul.vulnerability_admin, or sn_vul.remediation_owner
* Application vulnerable items (AVITs): sn_vul.app_sec_manager, sn_vul.app_security_champion
* Container vulnerable items (CVITs): sn_vul_container.vulnerability_analyst, sn_vul_container.vulnerability_admin, or sn_vul_container.remediation_owner
{#sem-modify-risk__ul_wsm_51l_5kc}

## About this task

You can modify the risk rating for individual findings and remediation tasks (VUL, AVUL, or CVUL). This action isn't available for Configuration Compliance test results or test result groups. Only findings in the
Open, Under Investigation, or Awaiting Implementation state are considered for risk change.

Risk modification is separate from requesting an exception. You don't need to complete a questionnaire, even if one is configured for exception requests. Associating a compensating control with the risk change is
optional.

If you're a Vulnerability Admin, the risk rating updates immediately. If you're a Remediation Owner, your request requires approval before the risk rating updates.  
Note:  
You can't change a finding's risk rating if its underlying vulnerability restricts risk changes. Resolve the restriction before proceeding. See [Disable or enable risk reduction for a CVE or TPE](https://www.servicenow.com/docs/_o1igT~fVz_ZAhuUDsN5uQ "As a Vulnerability Manager and Analyst, you can disable or enable the risk reduction requests for the host vulnerabilities associated with a Common Vulnerability Entry (CVE) or Third-party Entry (TPE) in the Security Exposure Management Workspace.").

## Procedure

1. Navigate to WorkspacesSecurity Exposure Management WorkspaceList.
2. Open the finding or remediation task whose risk rating you want to change.
3. Select Modify risk from ![more option]()more option.  
   Note:  
   If you're a Remediation Owner, select Request Risk Modification.
4. Complete the fields in the dialog.  
   See [Modify risk and Request risk modification form fields](https://www.servicenow.com/docs/Y9ezH7nmsq92PlbzIAhsRQ "The following table shows the fields on the Modify risk and Request risk modification dialogs.") for more information on the fields.
5. Select Apply.

## Result

If you're a Vulnerability admin or an analyst, the risk rating updates immediately and a confirmation message appears.

If you're a Remediation Owner, a risk modification request is submitted for approval. The risk rating updates to your selected value only after the request is approved.  
Note:  
The sn_sec_exception.modify_risk_approval_required system property controls whether a Remediation Owner request requires approval. This property is set to true by default. If set to false, the change approval moves directly to Approved and the risk rating updates immediately for Remediation Owners too.
* **[Modify risk and Request risk modification form fields](https://www.servicenow.com/docs/Y9ezH7nmsq92PlbzIAhsRQ)**   
  The following table shows the fields on the Modify risk and Request risk modification dialogs.

**Related tasks**   

* [Request bulk exception in the Security Exposure Management Workspace](https://www.servicenow.com/docs/SVN8qTeLwKylhvMaOly9Dg "Request an exception for multiple findings concurrently using the bulk edit feature instead of manually selecting each record.")
* [Add a compensating control to the library](https://www.servicenow.com/docs/o0hv1Q_YegzexmTE0LOIrQ "As a Vulnerability Manager or Analyst, add a list of compensatory controls to the Compensating Controls library in the Security Exposure Management Workspace, which can be applied for the risk reduction of host vulnerable items and remediation tasks.")
* [Approve or reject requests in the Security Exposure Management Workspace](https://www.servicenow.com/docs/DIFBHlFqZbLGcNodR9KjpQ "Approve or reject requests that are submitted by remediation owners.")

*[\>]: and then