SLA and remediation
How TrekShield tracks remediation deadlines by severity, what pauses the clock, which alerts you receive, and how a fix moves from open to verified.
TrekShield tracks two clocks. Both are set by severity.
Finding SLA (TrekShield’s side)
From the moment a finding is created, TrekShield aims to get it reviewed and reported to you within a number of days:
| Critical | High | Medium | Low | Info |
|---|---|---|---|---|
| 3 | 7 | 14 | 30 | 60 |
Breaches of this clock alert TrekShield’s engagement managers, not you.
Remediation SLA (your side)
When a remediation is created without a chosen date, its due date is set from the finding severity:
| Critical | High | Medium | Low / Info |
|---|---|---|---|
| 14 days | 30 days | 60 days | 90 days |
The Assign Remediation dialog pre-fills a due date seven days out, and the person assigning can change it. The date on the remediation is the one that counts. Your dashboard shows breaches, items at risk and mean time to remediate.
These are the platform’s default day counts. What is committed for your engagement is set by your engagement agreement.
What pauses the clock: a remediation marked Blocked, and an engagement placed On hold. Paused remediations are not flagged as overdue.
Alerts: overdue remediations are checked every six hours and notify the assignee and TrekShield managers. A daily check warns assignees of remediations due within three days. Email follows your notification settings.
Remediation lifecycle
| State | Meaning |
|---|---|
| Open | Assigned, not yet seen |
| Acknowledged | Developer has reviewed it |
| In progress | Fix under way |
| Fix submitted | Developer describes the fix (at least 10 characters) |
| Verified | A pentester confirmed the fix |
| Blocked | Cannot proceed; reason of at least 10 characters |
| Risk accepted | Risk formally accepted; reason of at least 50 characters |
A pentester can send a submitted fix back to In progress with a reason. After three rejections the fix must be escalated to an engagement manager for reassignment or risk acceptance. When a remediation is verified, its finding becomes Verified automatically.
Critical and high findings cannot be risk-accepted directly by a Client Administrator. They go through an approval step by a TrekShield engagement manager (findings guide).
To work through a fix step by step, see remediations and retests.
Last updated: 2026-10-18