A scan is more than invoking a tool. QFinch treats asset identity, authorization, policy, capacity, evidence and reporting as parts of one lifecycle.
Next step: Trace one report back to its asset, policy, engine stages and comparable rescan.
Register and authorize
The user selects an organisation and registers a supported asset. Ownership or explicit consent determines whether active assessment is eligible. Repository and container integrations also bind provider scope and immutable identity where possible.
Resolve policy
The current approved policy determines eligible scan types and requirements. The scan retains a snapshot so later policy changes do not rewrite historical context.
Admit and execute
A request enters an asynchronous queue. Capacity controls protect host and engine stability. The chosen scanner ensemble records completed, warning, failed, skipped and inapplicable engines.
Normalize and report
Raw observations are transformed into a stable report contract and correlated where evidence supports it. Reports include findings, coverage, provenance, artifacts and remediation rather than only a total count.
Remediate and verify
Teams triage, assign or suppress findings with recorded rationale. A later scan provides new evidence and supports verification. Historical results remain tied to their original asset, revision and policy.
This lifecycle allows a user to distinguish “no findings” from “coverage incomplete,” which is essential for defensible decisions.