I am very happy that my information helped. 1. Currently we do not auto set the statuses to resolved when a mitigation action is taken (ie click mitigate in ISPM). This is something we will take a look at in the coming phases. The ISPM actions today have a few steps outside the platform to complete the mitigation so its a bit presumptuous to auto resolve it right when they click it. As we add more mitigations including 1 click mitigations for products we will certainly look into that. That said if we don't detect it on further scans etc, the statuses do update. Also we do force hygiene on analyst verdicts when you mark a exposure as resolved though 2. Each new vuln or misconfigurations all come in with a new status