An observation is one security finding in your register: something you noticed, what it puts at risk, and what to do about it. The trick to SecurityTrackr is that you don't have to write it up formally. You describe what you found in plain words, the AI drafts the structured finding, and you review and save. Here's the whole flow, the handful of things that make an observation good, and the few that make it useless.
One observation, one finding
One observation holds the facts about one issue, its assessed risk and the work needed to treat it. Split unrelated issues into separate observations so each can have its own rating and decision.
First, set up your organisation
Complete your profile under Account → Organisation. It gives the AI background about your environment. It does not replace the evidence in a finding: name the affected system and controls that actually protect it in your observation.
Making your first one
Three steps: you write, the AI drafts, you review. The middle one is the AI's; the first and last are yours.
Step 1: say what you found
Open New observation. Start with Your Observation. Write what you saw the way you'd say it to a colleague:
| What you could write | Why it helps |
|---|---|
| The production VPN accepts four-character passwords. MFA is enforced for every VPN account. | The affected service, the weak setting and a control already in place. |
| Our nightly backup runs successfully, but nobody has tested restoring the finance database in the last year. | A specific recovery gap without claiming that the backups have failed. |
| A former contractor still has access to the shared project folder two weeks after their contract ended. | An observed access issue, the affected resource and when it was found. |
That single note is the minimum. Everything else on the form is optional and exists to make the draft sharper. If you have the context, spend two minutes on it:
- Affected systems / assets. List hostnames and IPs, with environment labels. e.g. FortiGate VPN Gateway (192.168.1.1), Azure AD (Production).
- Existing mitigating controls. Controls already in place, not planned ones. The AI factors them into the risk call. e.g. VPN only reachable from the corporate network, MFA enforced.
Step 2: let the AI draft it
Hit generate and the model turns your note into a structured finding: a formal title, a summary covering what, where and why, a likelihood and impact call, recommendations, ISO and NIST mappings, and a set of search keywords. It also pulls any existing controls you mentioned (anywhere in your text, not just the controls field) into their own list.
Step 3: review, then save
The finding has not entered your register yet. Read the summary, check likelihood and impact, trim or add recommendations, adjust the ISO areas. If the finding looks like one you've logged before, a duplicate warning flags it during review so you don't end up with two of the same thing.
What makes a good one
The AI handles the formal write-up. Your job is to feed it something accurate and specific. The difference between a sharp finding and a vague one is all in what you put in.
| Be concrete. | Name the system, the version, the setting, exactly what you saw. Specifics give the AI something to work with. |
| One finding per observation. | So the risk rating and treatment decision actually mean something. Split a multi-issue note into separate observations. |
| Note controls already in place. | They change the risk. The AI reads them straight out of your text. |
| Don't paste a whole scanner dump in. | Split it, or use the dedicated import tools for bulk findings. One observation is one issue. |
| Don't be vague. | “Security needs improving” gives the model nothing. Say what's wrong and where. |
| Don't list missing or planned controls as existing ones. | That field is for what's deployed today. Planned work belongs in recommendations. |
| Don't paste live secrets or credentials. | Describe them, don't reproduce them. Fields are encrypted at rest, but there's no reason to store a working key. |
None of this needs to be polished prose. Get the facts right, name the systems, and let the draft do the formatting. The one thing worth a second look every time is the risk rating: the AI proposes it, but you own it.
Choose what happens next
A new observation starts in Awaiting Triage. Assign responsibility and choose how to treat it. Continue with risk scoring to understand the assessment, or risk treatment to work through mitigation or acceptance.