Concept
Accepted risk
Sometimes the right decision is to keep a finding, for now. Pathwarden makes that decision explicit, explained and temporary.
On this page
In one sentence: an accepted risk is a finding you've decided to keep, written down with a reason and, ideally, a review date, so it stops counting against you without disappearing.
When accepting a risk is right
Not every finding can be fixed this week. A break-glass account may need to stay outside Protected Users. A LAPS rollout may take a quarter. A legacy application may need a weaker setting until it's replaced.
Ignoring those findings hides them; leaving them open drowns the real work in noise. Accepting them records the decision: who decided, why, and until when.
How it works
An accepted risk matches either one finding, by its finding ID, or a whole rule. It needs a reason, and it can have a review date (expires in the file, Review by in the app). In pathwarden.toml:
[[suppress]]
fingerprint = "PW-004-13b0863341b2e306"
reason = "Break-glass account, reviewed quarterly (CHG0012345)"
expires = "2027-01-31"
[[suppress]]
rule = "PW-011"
reason = "LAPS rollout tracked in PRJ0042"
expires = "2026-12-31"In the app, open a finding in the report and choose Accept risk: a dialog asks for the reason and an optional Review by date, and writes the same entry for you. The Settings page lists every accepted risk and marks the ones past their review date. On the command line, --review-by sets the date.
What changes, and what doesn't
- Accepted risks don't count in the headline numbers, the Tier Zero protected count or
--fail-on. - They stay visible on request: tick Show accepted risks in the report, or pass
--show-suppressedon the command line. - They count as open again after their review date, so a temporary exception can't become permanent by accident.
- Scheduled runs track them as accepted risk (
suppressedin the JSON), separate from open and fixed.
Good practice
- Always set a review date. It turns "accepted" into "accepted until we look again".
- Put a ticket or change number in the reason. It links the decision to whoever made it.
- Prefer one finding to a whole rule. Rule-wide acceptance hides new findings of that kind too.
- Review them with your auditors. A short list of explained, dated exceptions is evidence of control; a long list without dates isn't.
References
- Pathwarden: The configuration file
- SpecterOps BloodHound docs: Risk acceptance