Veracode is changing how we calculate the First Found Date for SCA in Analytics to bring it further into alignment with the definition of First Found for all other scan types in the Veracode Platform.

Previously, Analytics would update the First Found Date for an SCA finding to be the same as the Reopened Date if a finding had been reopened, which is in alignment with what SCA portrays in the platform. The upcoming adjustment will ensure that any reopened findings’ First Found Date do not update upon reopening, but instead retains the latest date of either when a CVE was published for a component or when a component with a new vulnerability was found in a codebase.

This change will affect only reopened findings by moving their First Found Date to an earlier date and increase the Finding Age of those findings. Time to Remediate and Grace Period calculations will not be affected by this change.

Please reach out to your CSM if you have any questions!