---
title: Create penetration test findings based on assessment requests \(prior to v19.0\)
description: Create penetration test findings based on the penetration test assessment request. These findings are manually-created Application Vulnerability Items \(AVIs\).
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/application-vulnerability-response/pen-test-create-avi.html
release: australia
product: Application Vulnerability Response
classification: application-vulnerability-response
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 3
breadcrumb: [Penetration testing, Use, Application Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Create penetration test findings based on assessment requests \(prior to v19.0\)

Create penetration test findings based on the penetration test assessment request. These findings are manually-created Application Vulnerability Items \(AVIs\).

## Before you begin

Role required: Ethical Hacker

## Procedure

1.  Navigate to **All** > **Self-Service** > **Service Catalog** > **Services** > **Penetration Test Assessment Requests**.

2.  To create an AVI for a penetration test assessment request, select the relevant request.

3.  In the Application Vulnerable Items section, select **New**.

4.  On the form, fill in the fields.

<table id="table_jdw_ccl_qqb"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Number

</td><td>

Automatically generated AVI identifier for this record.

</td></tr><tr><td>

Assessment request

</td><td>

Penetration test assessment request with which this AVI is associated.

</td></tr><tr><td>

Vulnerability

</td><td>

Vulnerability selected from the Vulnerability Entries table using the search option.

</td></tr><tr><td>

Risk rating

</td><td>

Quantified **Risk Score** separating vulnerable items into Critical, High, Medium, Low, and None. For more information on risk ratings, see [Calculate risk in Application Vulnerability Response automatically](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-calculators-rules.md).Starting from V16.1, by default the value is the same as the severity of the vulnerability.

</td></tr><tr><td>

Impacts any compliance program?

</td><td>

Confirms whether there is an impact on any compliance program. Choices are Yes and No.

</td></tr><tr><td>

List of compliance programs impacted

</td><td>

This field is displayed when then value of the 'Impacts any compliance program' field is set to **Yes**. Lists the impacted compliance programs.

</td></tr><tr><td>

Planned release/fix version

</td><td>

Release by when the penetration test findings must be resolved.

</td></tr><tr><td>

State

</td><td>

Default value is **Open** when the AVI is created. See [Application Vulnerable Item \(AVI\) states](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-states.md) for more information on how states are mapped.

</td></tr><tr><td>

Assignment group

</td><td>

Group selected to work on this AVI. Can be manually added or edited by an App-Sec Manager.

</td></tr><tr><td>

Assigned to

</td><td>

Individual from the selected assignment group that works on this AVI. Can be manually added or edited by an App-Sec Manager.

</td></tr><tr><td>

Remediation target

</td><td>

Date by which the AVIs must be remediated, since first identified. This field only appears when applicable.For more information on remediation targets, see [Automate remediation target tracking in Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-time-to-remediate-rules.md).

</td></tr><tr><td>

Created

</td><td>

Timestamp when the application vulnerable item \(AVI\) was created.

</td></tr><tr><td>

Updated

</td><td>

Timestamp when the application vulnerable item \(AVI\) was updated.

</td></tr><tr><td>

Opened by

</td><td>

User who created this penetration test finding.

</td></tr><tr><td>

Security team contact

</td><td>

Point of contact in the ethical hacking team.

</td></tr><tr><td>

Short description

</td><td>

Brief explanation of the penetration test finding.

</td></tr><tr><td colspan="2">

Details

</td></tr><tr><td>

Technical details

</td><td>

Technical details of the penetration test finding.

</td></tr><tr><td>

Impact

</td><td>

Assessment of the impact of the penetration test finding.

</td></tr><tr><td>

Steps to reproduce

</td><td>

Document the steps to reproduce and review the penetration test finding.

</td></tr><tr><td>

Recommendation

</td><td>

Record the recommended actions in this field.

</td></tr><tr><td colspan="2">

Notes

</td></tr><tr><td>

Work notes

</td><td>

Add notes to communicate information about state transitions and other field updates.

</td></tr><tr><td>

V16.1: Affected URLs

</td><td>

Further information related to the affected URLs.

</td></tr><tr><td>

V16.1: Affected parameters

</td><td>

Further information related to the affected parameters.

</td></tr><tr><td>

V16.1: Affected functionalities

</td><td>

Further information related to the affected functionalities.

</td></tr></tbody>
</table>5.  To save the form, select **Submit**.