> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tolmo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Retest a fix

> Retest a finding to replay its exploit after you ship a fix. Learn which agent runs, what Resolved means, and which findings you cannot retest.

When you retest a finding, Tolmo's agents try to exploit it again on your live authorized target. If the exploit does not work, the finding becomes **Resolved**.

## Retest a finding

1. Ship the fix to the environment that the agent tested.
2. Retest the finding.
3. Tolmo starts a verification run and tells you which agent runs.

Tolmo runs only one retest for each finding at a time. If a retest is already in progress, Tolmo tells you.

## The agent that runs

Tolmo selects the agent from what it knows about the finding.

| The finding is… | Agent | What the agent does |
| - | - | - |
| Not proven | **Blue team agent** | Tries to prove the finding with a first exploit. |
| Exploited before | **Green team agent** | Replays the stored exploits on the live target. |

You can see the run in the run history of that agent and in [Mission Control](https://docs.tolmo.com/agents/mission-control.md).

## Retest results

| Result | New exploitability | What to do |
| - | - | - |
| The exploit does not work | **Resolved** | Close the finding. |
| The exploit still works | **Validated exploit** (no change) | The fix did not close the issue. Read the new evidence. |
| The agent proved the issue for the first time | **Validated exploit** | Fix the issue. See [Fix a finding](https://docs.tolmo.com/pentesting/fix.md). |
| The agent showed that the issue is not exploitable | **Not exploitable** | Mark the finding as a false positive, or close it. |
| The run did not get a clear result | No change | Read the run to find what was missing, such as credentials. |

If the target of a finding is outside your authorized domains, the finding waits with the state **No permitted domain**. [Enable offensive testing on the domain](https://docs.tolmo.com/pentesting/scope.md), then retest.

## Findings that you cannot retest

You cannot retest these findings:

* A draft finding. Publish the draft first.
* A CVE finding, such as a vulnerable package version from a dependency scanner. To fix a CVE finding, upgrade the package. The scanner then reports the change.
* An older exploited finding that has no stored exploit. Tolmo exploited these findings before it started to store exploits that it can replay.

## Testing hours

You can set [testing hours](https://docs.tolmo.com/pentesting/production-changes.md#limit-blue-to-testing-hours). If you request a retest outside these hours, the retest waits until the testing hours start. Tolmo tells you when the retest will start.

## Closed findings stay closed

You can close a finding or mark it as a false positive. The next run does not show that finding as new again.

## Next steps

> [card] [Validate the findings you already have](https://docs.tolmo.com/pentesting/third-party-findings.md)
>
> Let Blue prove or disprove alerts from your scanners.

> [card] [Mission Control](https://docs.tolmo.com/agents/mission-control.md)
>
> See all agent runs in one place.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.