Resolved, false positive and risk accepted are not the same thing. Getting the distinction right determines what your report says six months later.
Closing a case is not a formality; it is the moment you create data. The wrong closure type corrupts every later measurement.
Resolved
The source of the finding is gone: the domain was removed, the port closed, the password reset. Re-running the same check should produce nothing.
False positive
The finding was never valid: the asset is not yours, or the detection matched incorrectly. This closure must feed back into the detection rule, or the same record returns.
Risk accepted
The finding is valid but consciously accepted. This closure needs an expiry and an owner. An open-ended risk acceptance is a lost case.
Why it matters
Put all three in one bucket and you can answer "how many findings did we close" but not "did our surface actually shrink".
