HailBytes ASM Patch: Medium Findings Now Visible in MSSP Portfolio View
June 11, 2026 • 3 min read
The June 2026 release introduced the MSSP portfolio view — inline security metrics on the All Projects page so operators can triage across client portfolios without drilling into each project. That release shipped open Critical and High finding counts per project. This patch adds the missing piece: open Medium findings are now visible in the same column.
What Changed
- Open Findings column now includes Medium severity — a Medium badge renders inline with the existing Critical and High badges when a project has open Medium findings
- "None" label is now accurate — it only displays when Critical, High, and Medium are all zero, rather than when only Critical and High are zero
- No migration, no configuration change — the updated badge renders automatically after upgrading
The Problem: Mediums Were Invisible at the Portfolio Level
Before this patch, the Open Findings column on the All Projects portfolio table showed badges only for open Critical and open High findings. A project that had zero open Criticals and zero open Highs — but dozens of open Mediums — displayed "None" in that column.
For an MSSP analyst doing a morning triage pass across a multi-client portfolio, "None" reads as clean. It is exactly the signal that says this client can wait. That reading is wrong: the client has outstanding findings, and depending on its sector and SLA terms, those findings may already be overdue for remediation.
Why Medium specifically?
Medium severity is the tier most commonly subject to a 30-day remediation SLA in MSSP contracts — shorter than the "best effort" window many clients assign to Lows, but longer than the 24-to-72-hour windows applied to Criticals. That SLA gap means Mediums are exactly the category that accumulates silently: too urgent to defer indefinitely, but not urgent enough to surface in a Critical-first triage pass. Missing them at the portfolio level is how they age past SLA without being noticed until a quarterly business review.
What It Looks Like Now
After this patch, the Open Findings column shows up to three badges per project — Critical, High, and Medium — each rendered only when the count is greater than zero. The Medium badge uses the platform's soft-info styling, matching the Medium color treatment used on finding detail pages throughout the application.
The "None" label now only appears when all three severity tiers are zero, which is the only condition where it is an accurate description of a project's open findings posture. A project with five open Mediums and no open Criticals or Highs now shows 5 Medium rather than "None".
The fix reuses the existing bounded _open_counts helper that already resolves Critical and High counts — the Medium count is a single additional severity filter added to the same grouped query. There is no per-row query and no N+1 regression; the portfolio table performs identically at any portfolio size.
Upgrading
This fix is included in the current HailBytes ASM Docker image. Pull the latest image to update. No data migration or configuration change is required. The Medium badge will appear immediately on the All Projects page after upgrading for any project with open Medium findings.
If your MSSP portfolio previously showed "None" for one or more client projects that you suspected had open findings, the corrected count will be visible as soon as the updated image is running. No rescan is needed — the count reflects current open findings in the existing database.
Deploy HailBytes ASM
Attack surface management with genuine MSSP portfolio visibility — Critical, High, and Medium findings surfaced at a glance across every client project, with no per-client page load required.