Documentation
Exceptions
Request, review and approve time-limited risk acceptances for vulnerabilities you decide not to fix yet.
Overview
An exception records a decision to accept the risk of one vulnerability on one asset, for a limited time and for a stated reason. Someone requests it with a business case; a different person with approval rights approves or rejects it. While the exception is approved, the vulnerability match is marked Accepted risk; when the exception is revoked or expires, the match returns to its previous status.
Use Exceptions to see every request, decide on pending ones, and keep an eye on exceptions that are about to expire.
Users with exceptions:request can request and withdraw exceptions. Users with exceptions:approve can approve, reject and revoke them. You need at least one of the two to open the page.
Screen tour
- The summary: how many exceptions are on record, how many are active, expiring and waiting for your decision.
- The status buckets: Pending decision, Expiring soon, At risk, Expired, Permanent, Healthy and Decided. Click a bucket to filter by it.
- Search by match, requester, or justification…
- Views, Filters and Export.
- Queue, Board, Table and Calendar: switch views.
- ?: shows the keyboard shortcuts.
- + New exception: starts a request.
- An exception. Click Open to see its details.
Request an exception
You request an exception for a specific vulnerability match, so you start from the match:
- Open Triage, or the Affected Assets tab of a CVE.
- On the match, click More (⋯), then Request exception.
- Fill in the form and click Request.
+ New exception on this page (or n) explains this and offers Go to triage.
- Match ID: the vulnerability match, filled in for you.
- Why now?: the reason category. See Reasons.
- Business case: why the remaining risk is acceptable and what reduces the impact.
- What’s reducing the risk?: compensating controls, such as “WAF rule” or “network segmentation”. Type one and click Add.
- Evidence (optional): links to tickets, scans or documents. Click + Add evidence URL for each.
- Suggested approver (optional): the user you would like to decide. Any user with approval permission can decide.
- Ends when: the expiry date, 90 days from today by default. Tick Set as permanent for an exception with no expiry.
Fields
| Field | Description | Rules |
|---|---|---|
| Match ID | The vulnerability on the asset that the exception covers. | Required. Filled in from the match. A match can have only one pending or approved exception at a time. |
| Why now? | The reason category. | Required. One of the six reasons. |
| Business case | Why the residual risk is acceptable. Mention CVE IDs and links; approvers read this first. | Required. At least 10 characters. |
| What’s reducing the risk? | Compensating controls, one per chip. | Optional. |
| Evidence (optional) | URLs that support the request. | Optional. |
| Suggested approver (optional) | The user who should review the request. It decides which approver’s My approvals view shows the request. | Optional. |
| Ends when | The date the exception expires. | Defaults to 90 days from today. Set as permanent removes the date; mention your review cadence in the business case. |
Request becomes available once Why now? and Business case are filled in.
Reasons
The Why now? field says why you are accepting the risk instead of fixing it:
| Reason | Use it when |
|---|---|
| Compensating control in place | Another control blocks the attack, for example a WAF rule, network segmentation or a disabled feature. |
| Awaiting vendor patch | No fix is available yet, and you will patch when the vendor releases one. |
| False positive (no exploit path) | The vulnerable code is present but can’t be reached or exploited in your setup. |
| Accepted business risk | The business has decided the risk is acceptable for now, for example because the impact is low. |
| Scheduled migration | The asset or software is being replaced or retired on a planned date. |
| Other | None of the above. Explain the reason in the business case. |
The reason is shown on the exception as a chip, and you can filter by it with Reason category.
Lifecycle
| Status | Meaning | Next possible status |
|---|---|---|
| Requested | Waiting for a decision. | Approved, Rejected, Withdrawn |
| Approved | Active. The linked match is Accepted risk. | Revoked, Expired |
| Rejected | An approver turned the request down. Final. | — |
| Withdrawn | The requester cancelled the request. Final. | — |
| Revoked | An approver ended an approved exception early. Final. | — |
| Expired | The end date passed. Final. | — |
- Approve: available to users with
exceptions:approve, except the requester. Approving marks the linked vulnerability match Accepted risk and stores its previous status. - Reject: available to users with
exceptions:approve. You can add a reason. - Withdraw: available to the requester while the request is pending.
- Revoke: available to users with
exceptions:approveon an approved exception. You can add a reason. - Expire: DeviceQuest expires approved exceptions automatically when their end date passes, checking at least every 15 minutes.
When an exception is revoked or expires, the linked match returns to the status it had before approval, provided nobody has changed it since. To start again after a final status, request a new exception.
Every change is recorded in the audit log.
Segregation of duties
The person who requests an exception can’t approve it. DeviceQuest hides Approve from the requester everywhere (the Queue, the status menu and the decision buttons on the exception page) and rejects the approval if it is attempted. Another user with exceptions:approve must decide.
Approve or reject
- Open the Views menu and choose My approvals to see the requests waiting for you, or click Pending decision.
- Read the business case, reason and evidence. Open the exception for the full details.
- Click Approve and confirm with Confirm approve, or click Reject…, optionally enter a Reason, and click Confirm.
You can also decide from the exception page.
Bulk approve
In Table view, select exceptions to show the bulk bar with N selected, Approve N, Reject N… and Clear selection. To approve them, click Approve N, then Confirm approve.
Bulk approve is allowed when:
- you select between 1 and 5 pending exceptions, and
- they all have the same reason category.
Otherwise the bar shows Bulk approve disabled, with the reason when you hover it: review larger or mixed batches one by one. Your own requests can’t be approved, in bulk or otherwise. Reject N… has no limit; you can add one reason for all of them.
Views
Click Queue, Board, Table or Calendar, or press v to cycle through them.
| View | What it shows |
|---|---|
| Queue | One exception at a time, ordered by urgency: pending requests first, older ones before newer, and expiring ones boosted. Each card explains why it is next, for example Awaiting decision, 4 days old, suggested approver: you. Decide in the Decision panel on the right. |
| Board | Pending requests in columns by suggested approver: You, Unassigned, and one column per approver. With many approvers, the board shows six columns and gathers the rest in Others (N). Any user with exceptions:approve can decide any request. |
| Table | All exceptions in rows with Match, Status, Reason, Requester, Approver, Expires and Requested. Sort by Match, Status, Expires or Requested. Select rows for bulk actions. |
| Calendar | Pending and approved exceptions plotted by expiry date over the next 90 days. Hover a chip for its details; click it to open the exception. |
The Calendar warns when five or more exceptions expire in the same week (N exceptions expire in week K), so you can plan renewals. Permanent exceptions are listed separately, because they have no expiry date.
Expiry
The expiry bar on every exception shows how much time is left:
| Time left | Shown as |
|---|---|
| No end date | ∞ permanent |
| More than 14 days | Healthy |
| 4 to 14 days | At risk |
| 0 to 3 days | Expiring |
| Past the end date | Nd overdue |
Saved views
Click Views to apply a view. Applying a view replaces the current filters.
| View | Shows |
|---|---|
| My approvals | Pending requests where you are the suggested approver |
| My requests | Every exception you requested, in any status |
| Expiring soon | Approved exceptions that end within 14 days |
| Active exceptions | All approved exceptions |
| Recently decided | Approved, rejected and revoked exceptions |
To save your own view, set the filters, click Views, then + Save current view…, and enter a name. Saved views are kept in this browser.
Filters
Click Filters to open Filter exceptions:
| Filter | Options |
|---|---|
| Status | Requested, Approved, Rejected, Withdrawn, Revoked, Expired |
| Reason category | The six reasons |
| Expiry window | Any expiry, Expires in ≤ 7 days, ≤ 14 days, ≤ 30 days, Already expired, Permanent |
| Match ID contains | Part of a match ID |
| Requester | A user |
| Suggested approver | A user |
Active filters show as chips. Click × on a chip to remove it, or Clear all. Filters, view and sort order are kept in the page address.
Export
Click Export and choose:
- Download CSV:
exceptions.csvwith ID, Status, Match ID, Requested By, Suggested Approver, Expires (or “permanent”), Requested At, Decided By and Decided At, for the exceptions currently shown. - Copy as Slack message: the first 10 exceptions, formatted for Slack.
- Copy as Jira/Linear markdown: the first 10 exceptions as Markdown.
Keyboard shortcuts
Press ? to show the list, and Esc to close it. Shortcuts are ignored while you type in a field.
| Key | Action |
|---|---|
| j / k | Next / previous exception (Queue view) |
| o | Open the exception (Queue view) |
| a | Approve (Queue view) |
| r | Reject (Queue view) |
| w | Withdraw (Queue view) |
| x | Revoke (Queue view) |
| v | Cycle through the views |
| n | New exception |
| e | Open the Export menu |
| ? | Show the shortcuts |