A pentest finding has to pass through four stages before it counts as a closed, verified fix: discovery and validation, structure, decision, and action. Most programs are strong at one or two of those stages and stalled at another. The self-check below is twelve statements that s