Create penetration test findings based on assessment requests \(prior to v19.0\)
Create penetration test findings based on the penetration test assessment request. These findings are manually-created Application Vulnerability Items (AVIs).
Before you begin
Role required: Ethical Hacker
Procedure
-
Navigate to All > Self-Service > Service Catalog > Services > Penetration Test Assessment Requests.
-
To create an AVI for a penetration test assessment request, select the relevant request.
-
In the Application Vulnerable Items section, select New.
-
On the form, fill in the fields.
|
Field |
Description |
|---|---|
|
Number |
Automatically generated AVI identifier for this record. |
|
Assessment request |
Penetration test assessment request with which this AVI is associated. |
|
Vulnerability |
Vulnerability selected from the Vulnerability Entries table using the search option. |
|
Risk rating |
Quantified Risk Score separating vulnerable items into Critical, High, Medium, Low, and None. For more information on risk ratings, see Calculate risk in Application Vulnerability Response automatically.Starting from V16.1, by default the value is the same as the severity of the vulnerability. |
|
Impacts any compliance program? |
Confirms whether there is an impact on any compliance program. Choices are Yes and No. |
|
List of compliance programs impacted |
This field is displayed when then value of the 'Impacts any compliance program' field is set to Yes. Lists the impacted compliance programs. |
|
Planned release/fix version |
Release by when the penetration test findings must be resolved. |
|
State |
Default value is Open when the AVI is created. See Application Vulnerable Item (AVI) states for more information on how states are mapped. |
|
Assignment group |
Group selected to work on this AVI. Can be manually added or edited by an App-Sec Manager. |
|
Assigned to |
Individual from the selected assignment group that works on this AVI. Can be manually added or edited by an App-Sec Manager. |
|
Remediation target |
Date by which the AVIs must be remediated, since first identified. This field only appears when applicable.For more information on remediation targets, see Automate remediation target tracking in Application Vulnerability Response. |
|
Created |
Timestamp when the application vulnerable item (AVI) was created. |
|
Updated |
Timestamp when the application vulnerable item (AVI) was updated. |
|
Opened by |
User who created this penetration test finding. |
|
Security team contact |
Point of contact in the ethical hacking team. |
|
Short description |
Brief explanation of the penetration test finding. |
|
Details | |
|
Technical details |
Technical details of the penetration test finding. |
|
Impact |
Assessment of the impact of the penetration test finding. |
|
Steps to reproduce |
Document the steps to reproduce and review the penetration test finding. |
|
Recommendation |
Record the recommended actions in this field. |
|
Notes | |
|
Work notes |
Add notes to communicate information about state transitions and other field updates. |
|
V16.1: Affected URLs |
Further information related to the affected URLs. |
|
V16.1: Affected parameters |
Further information related to the affected parameters. |
|
V16.1: Affected functionalities |
Further information related to the affected functionalities. |
--- title: Create penetration test findings based on assessment requests \(prior to v19.0\) description: Create penetration test findings based on the penetration test assessment request. These findings are manually-created Application Vulnerability Items \(AVIs\). locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/security-management/application-vulnerability-response/pen-test-create-avi.html release: australia product: Application Vulnerability Response classification: application-vulnerability-response topic_type: task last_updated: "2026-09-10" reading_time_minutes: 3 breadcrumb: [Penetration testing, Use, Application Vulnerability Response, Unified Security Exposure Management, Security Operations] --- # Create penetration test findings based on assessment requests \(prior to v19.0\) Create penetration test findings based on the penetration test assessment request. These findings are manually-created Application Vulnerability Items \(AVIs\). ## Before you begin Role required: Ethical Hacker ## Procedure 1. Navigate to **All** > **Self-Service** > **Service Catalog** > **Services** > **Penetration Test Assessment Requests**. 2. To create an AVI for a penetration test assessment request, select the relevant request. 3. In the Application Vulnerable Items section, select **New**. 4. On the form, fill in the fields. <table id="table_jdw_ccl_qqb"><thead><tr><th> Field </th><th> Description </th></tr></thead><tbody><tr><td> Number </td><td> Automatically generated AVI identifier for this record. </td></tr><tr><td> Assessment request </td><td> Penetration test assessment request with which this AVI is associated. </td></tr><tr><td> Vulnerability </td><td> Vulnerability selected from the Vulnerability Entries table using the search option. </td></tr><tr><td> Risk rating </td><td> Quantified **Risk Score** separating vulnerable items into Critical, High, Medium, Low, and None. For more information on risk ratings, see [Calculate risk in Application Vulnerability Response automatically](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-calculators-rules.md).Starting from V16.1, by default the value is the same as the severity of the vulnerability. </td></tr><tr><td> Impacts any compliance program? </td><td> Confirms whether there is an impact on any compliance program. Choices are Yes and No. </td></tr><tr><td> List of compliance programs impacted </td><td> This field is displayed when then value of the 'Impacts any compliance program' field is set to **Yes**. Lists the impacted compliance programs. </td></tr><tr><td> Planned release/fix version </td><td> Release by when the penetration test findings must be resolved. </td></tr><tr><td> State </td><td> Default value is **Open** when the AVI is created. See [Application Vulnerable Item \(AVI\) states](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-states.md) for more information on how states are mapped. </td></tr><tr><td> Assignment group </td><td> Group selected to work on this AVI. Can be manually added or edited by an App-Sec Manager. </td></tr><tr><td> Assigned to </td><td> Individual from the selected assignment group that works on this AVI. Can be manually added or edited by an App-Sec Manager. </td></tr><tr><td> Remediation target </td><td> Date by which the AVIs must be remediated, since first identified. This field only appears when applicable.For more information on remediation targets, see [Automate remediation target tracking in Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-time-to-remediate-rules.md). </td></tr><tr><td> Created </td><td> Timestamp when the application vulnerable item \(AVI\) was created. </td></tr><tr><td> Updated </td><td> Timestamp when the application vulnerable item \(AVI\) was updated. </td></tr><tr><td> Opened by </td><td> User who created this penetration test finding. </td></tr><tr><td> Security team contact </td><td> Point of contact in the ethical hacking team. </td></tr><tr><td> Short description </td><td> Brief explanation of the penetration test finding. </td></tr><tr><td colspan="2"> Details </td></tr><tr><td> Technical details </td><td> Technical details of the penetration test finding. </td></tr><tr><td> Impact </td><td> Assessment of the impact of the penetration test finding. </td></tr><tr><td> Steps to reproduce </td><td> Document the steps to reproduce and review the penetration test finding. </td></tr><tr><td> Recommendation </td><td> Record the recommended actions in this field. </td></tr><tr><td colspan="2"> Notes </td></tr><tr><td> Work notes </td><td> Add notes to communicate information about state transitions and other field updates. </td></tr><tr><td> V16.1: Affected URLs </td><td> Further information related to the affected URLs. </td></tr><tr><td> V16.1: Affected parameters </td><td> Further information related to the affected parameters. </td></tr><tr><td> V16.1: Affected functionalities </td><td> Further information related to the affected functionalities. </td></tr></tbody> </table>5. To save the form, select **Submit**.
| title | Create penetration test findings based on assessment requests \(prior to v19.0\) |
| description | Create penetration test findings based on the penetration test assessment request. These findings are manually-created Application Vulnerability Items \(AVIs\). |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/australia/security-management/application-vulnerability-response/pen-test-create-avi.html |
| release | australia |
| product | Application Vulnerability Response |
| classification | application-vulnerability-response |
| topic_type | task |
| last_updated | 2026-09-10 |
| reading_time_minutes | 3 |
| breadcrumb | Penetration testingUseApplication Vulnerability ResponseUnified Security Exposure ManagementSecurity Operations |