Vulnerable Items Reopening AutomaticallyDescriptionVulnerable items are reopening automatically and unexpectedly with no action from the user.CauseThe vulnerable item records were marked as 'False Positive'. Upon the 'Date Expired', the "Check Vulnerable Item and Groups Deferment Expiration" scheduled job reopens the false positive records. A false positive without an Until date is a permanent false positive. After the false positive expires, the state of the VI(vulnerable item) or VG(vulnerable group) moves back to Open. You can read more about it here: https://docs.servicenow.com/bundle/paris-security-management/page/product/vulnerability-response/concept/vr-false-positive.html If you check lines 58-60 you will see the state is being set to '1', or closed. Parameter 5 for sendIsExpiredNotificationAndReopen is the new state value. // Send out notifications, and change state for closed-false positive, for false positive expired sendIsExpiredNotificationAndReopen('sn_vul_vulnerable_item', 'sn_vul.vi_marked_as_fp_expired', '3', '22', '1'); sendIsExpiredNotificationAndReopen('sn_vul_vulnerability', 'sn_vul.vg_marked_as_fp_expired', '3', '22', '1');ResolutionIf you do not want the record do be reopened (for false positive VIT's) the recommendation is to clear the "Reason" and "Until" field before closing the VIT.