Remediated VITs are not closingIssue <!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Description: We have VITs that were remediated 10/25/2025 that are still showing as active VITs. The vulnerability scanning tool in MS Defender shows no active vulnerability, however, ServiceNow continues to show assets are vulnerable. This may present like: • Detection is Open, but the VIT is Closed• Detection is Closed, but the VIT is Open• OR both Detection and VIT are Open Symptoms<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } If you have vulnerabilities that were patched and around 24 hours, may notice that the VIT was closed. You check Work Notes and there might be no reference to auto close rule being applied and changing the status.If the auto-close rule applies, then this should be "across board" and all other VITs that are remediated are having to wait for however many days are set in the auto-close rule.This is not the case and is the issue as you might have complaints about false positive reporting if a CI was remediated today and it is still showing up as exposed. e.g. You may work to remediate a an sn_vul_vulnerable_item on some date, then the VIT was closed the following day around the time the "Delta" job [e.g. Microsoft TVM Machine Vulnerabilities Integration (Delta Import)] runs.Based on the VIT notes there may be no references to auto-close rule. Facts<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } The expectation is that when a CI is remediated on the next Delta scan the VIT associated with that CI will no longer be active. As in the case of remediated on 1/8, closed on 1/9 as reported via the "Delta" import. Note that VITs aren't audited [thus nothing in the record history]. Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Yokohama Patch 4 to P7 Resolution<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } ...The VR system is good about placing worknotes in there; and it may actually look normal. For example, in detections:• One closed detection, which means it was either reported closed by the scanner or it was remediated by someone manually fixing that.• The other is 'stale', which means 90 days have passed and the scanner didn't report it ...so we're assuming it closed. That is done by whatever auto-close rules the customer has configured [default is 90 days]....So appropriately, this VIT is 'closed' / 'fixed' which looks like someone remediated it. the VIT is closed when all of the associated detections are closed.• This particular VIT moved to closed by VR system e.g. on 12/2 by an auto-close rule.• The 'first found' is when it was first detected by the scanner [e.g. MS Defender],• then reported to ServiceNow through the integration,• which reports the detection on 10/14 as a 'vulnerable item'• someone then remediated that; fixed it and marked it as 'closed' This is what confuses some users:• It may later then be RE-detected on 10/23, then opened on 10/24 -- which note the second detection was 'last found' on 10/23. So what it's working as designed: a new detection probably happened [whether active or passive]. This also explains the different 'integration runs' because they were run at different times [10/14 > fixed, and then 10/23 > was not fixed]. 'stale' means ServiceNow can't be certain it was fixed ...but we don't 'see' it any more since the 3rd-party scanner is the Source Of Truth, not ServiceNow. It may look like it took 'over a month to be closed', but it actually does close when it was remediated, THEN it can be re-opened, then can go stale when it wasn't reported again for 90 days. The VIT is a combination of records which is matching detections [detection records] to a configuration item. e.g. you work laptop is detected by an IP sniffer checking for open ports AND is ALSO report by software that exists right on your laptop ...which says hey this port is open. This would be two different detections from two different sources for the same item ....and for the same CI asset. Also keep in mind:• if the scanner does not report through the integration, that it has been fixed, then SN will not mark it as 'closed fixed' -- which is the absolute certain state.• if not received from the scanner -- we won't touch it.• if it goes for 40 days [or the set policy], it's marked at 'stale' but we're not >certain<.