0% completed
Survey Introduction

User Survey: Security Scanner Findings in Practice

Welcome to my study and thank you for participating. This survey is part of my master’s thesis and examines how security scanners and the findings generated from scanning own code are handled in practice.

Explanation of Key Security Terms

In the following survey the explained terms will be used:

  • Vulnerability Scanner – A tool that automatically scans systems or networks to detect vulnerabilities and security weaknesses.
  • Vulnerabilities – Weaknesses in a system, application, or network that can be exploited by attackers to compromise security.
  • Security Findings – Potential issues or weaknesses identified by automated scanners during a security assessment.

Sample data record for a security finding

Attribute Example Value
TitleSQL Injection in Login Form
Finding IDFND-2026-001
CWE IDCWE-89
Vulnerability CategoryInjection
SeverityHigh
CVSS Score8.8
Business ImpactUnauthorized access to customer data
ExploitabilityHigh (no authentication required)
ConfidenceHigh
Affected AssetsWeb Application (Login Endpoint)
Attack VectorRemote
ReproducibilityAlways reproducible
File Path/app/controllers/auth.py
Code LocationLines 42–55
DescriptionImproper input handling allows SQL injection attacks
Discovery MethodManual code review and penetration testing
Report Date2026-03-23
Time to Fix5 days
Editing StatusNot started