# Alerts and weekly triage

SecOps notifications help admins notice overdue vulnerability work and high exploit-likelihood findings. A weekly triage note gives a starting point for the team's review.

## What raises an alert?

The app has two finding-alert rules:

| Alert | What it concerns |
| --- | --- |
| SLA breach | A team with open findings past their remediation deadline |
| Likely exploitable | An open vulnerability finding with an available EPSS probability at or above 50% |

An alert is raised once while its condition remains active. After it clears, the condition can raise a new alert if it returns. Read [Deadlines](/docs/secops/deadlines) and [EPSS](/docs/secops/vulnerabilities#epss-probability-and-percentile) to understand the underlying measures.

These rules do not automatically alert for every Access attention item. A listed MFA or credential concern is something to investigate in its chapter, rather than a promise of a notification or ticket.

## What does Scout send?

Starting SecOps installs a Scout operator, visible under **Workspace → Operators**. Once a week, environment admins receive a short triage note in portal notifications.

The note summarises open findings against four weeks earlier, overdue work, an urgent fix and exploit-likelihood or missing-owner attention. It is composed from fixed rules and the app's figures, without an AI model.

**This week** describes the review cadence. It does not turn the daily source pulls into continuous monitoring. A stale source can leave a note based on the last available measurements.

## Use the note as a starting point

Open the relevant finding or fix, confirm coverage and ownership, and decide the next action. A notification is not evidence that an attacker reached your system, and the absence of a notification is not evidence that every provider is secure.

Use [Jira tickets](/docs/secops/tickets) for vulnerability fix work and [Access reviews](/docs/secops/access-reviews) to record account-change investigations. See [Operators](/docs/operators/overview) for the broader operator interface.