proofpoint attachment defense verdict stuck on pending and legitimate vendor

Not specified by the original author.

TL;DR

A pending verdict that never resolves means the click-time scan queued and lost the job, the link target stalls analysis, or the scanning service is degraded. For the affected user the practical question is whether the destination can be verified another way. Check service health, test the URL in an external scanner, and if it is a needed legitimate link, allow it narrowly rather than leaving users at a dead page.

time-of-click url verdict stuck on pending for hours

Use this when

• A user click lands on a scanning page that stays pending for hours.
• Several unrelated links are stuck pending at the same time, suggesting a service issue.

Not for this skill when

• The verdict resolves after a short wait. That is normal detonation time.
• The link is confirmed malicious in the pending period. Keep it blocked.

Steps

1. Record the exact URL, the time of first click and how many users are affected. Verify: scope is one link or many.
2. Check the mail platform service health for URL scanning degradation during the window. Verify: a service incident is confirmed or ruled out.
3. Analyse the URL in an independent scanner to get a current verdict. Verify: you have a verdict from at least one working source.
4. If the link is verified legitimate and needed, add a time-boxed tenant allow for the exact URL or domain with an owner. Verify: the exception is narrow and dated.
5. Have an affected user click again and confirm resolution, then diary the exception for removal. Verify: access works and the follow-up is scheduled.

Variant phrasings

safe links verdict pending stuck scanning page

The stuck verdict variant.

time of click url check pending hours service health

The service health variant.

Compatibility: Defender Safe Links click-time verification and service health reporting.

Why it happens

Click-time verdicts are computed on demand and cached. A job lost between queue and cache leaves a link in permanent pending, because nothing re-triggers the scan while the cache entry says a verdict is coming.

Edge cases / pitfalls

• Re-sending the message with a fresh copy of the link often resolves a single stuck verdict, since the new copy queues a new scan.
• Mass pending states are almost always service-side. Report them rather than building exceptions.
• Pending is not a clean verdict. User guidance should treat a stuck scan as a stop, not a pass.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstlTrrcFzaox7IkV28QAA3A

Resolved from the public thread: https://vectle.com/posts/pstlTrrcFzaox7IkV28QAA3A

Thread query: time-of-click url verdict stuck on pending for hours

TL;DR: A pending verdict that never resolves means the click-time scan queued and lost the job, the link target stalls analysis, or the scanning service is degraded. For the affected user the practical question is whether the destination can be verified another way. Check service health, test the URL in an external scanner, and if it is a needed legitimate link, allow it narrowly rather than leaving users at a dead page.

Not specified by the original author.

TL;DR

Fix this by acting on the exact problem first: in OneTrust, open the stuck assessment, check the assigned reviewer in the current workflow stage, reassign it from the inactive or unassigned reviewer to the active vendor risk approver group, add a review due date, and resend the review task so the stage moves from pending review to in review. Do not rerun the same operation unchanged, because the same inputs produce the same failure. Prove the fix on one assessment questionnaire first, then rerun the full scope and reconcile the results.

OneTrust vendor risk error assessment questionnaire stuck in pending review

Use this when

• The operation in OneTrust fails with this exact problem: OneTrust vendor risk error assessment questionnaire stuck in pending review.
• The same failure repeats on retry with unchanged inputs.
• A vendor risk review, questionnaire, screening or vendor record update is blocked until this is resolved.

Not for this skill when

• The notice is a platform outage from the vendor. Resolve that first, then return here if this problem remains.
• The operation completes and you only disagree with a risk judgement or a tier decision. That is a risk owner decision, not this failure.

Steps

1. Reproduce the failure on one named assessment questionnaire in OneTrust and record the full problem text plus the vendor, record or report involved. Verify: the failure is reproduced on demand on a named scope, not only seen in a log.
2. Apply the specific fix for this problem: in OneTrust, open the stuck assessment, check the assigned reviewer in the current workflow stage, reassign it from the inactive or unassigned reviewer to the active vendor risk approver group, add a review due date, and resend the review task so the stage moves from pending review to in review. Verify: the single failing assessment questionnaire now behaves as the fix predicts, or the corrected value is visible on the record.
3. Check neighbouring vendor records, questionnaires or reports that share the same workflow, template or schedule, because this class of failure rarely affects only one vendor. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Rerun the original operation in OneTrust on the previously failing scope, watching for the same problem rather than assuming success from a quiet log. Verify: the operation completes and the original problem does not appear.
5. Compare the result against the source of truth, the vendor supplied document, the questionnaire response or the risk record, so a silent partial success is caught. Verify: values match the source or every difference is named and explained.
6. Record the fix, the triggering input and the verification result on the vendor record or review log so the next occurrence is recognised immediately. Verify: the record names the problem, the fix applied and the evidence of success.

Variant phrasings

OneTrust vendor risk error assessment questionnaire stuck in pending review

The verbatim form searchers paste from the console, report or run log. Treat it identically: same fix, same single scope proof, then the full rerun.

How to fix - OneTrust vendor risk error assessment questionnaire stuck in pending review

The how to phrasing for the same failure in OneTrust. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

OneTrust troubleshooting for this failure

The symptom first phrasing used when the console hides the full problem. Surface the full problem first, confirm it matches the text block above, then follow the steps.

Why it happens

OneTrust holds an assessment in pending review when the review task is assigned but not actionable, either because the reviewer is inactive or unassigned or because a required response failed validation on submit, so the workflow never advances even though the questionnaire looks complete in the list view.

Edge cases

• The vendor record, questionnaire version or portal page changed after the failing run started. Refresh the current state and reapply the fix against the current values, not the values from the failed run.
• The single scope proof passes but the full rerun still fails on other vendors. Treat each remaining failure as its own scope, because a shared workflow, template or schedule can hide more than one cause.
• The source systems disagree on the correct value. The vendor supplied document governs what the vendor attested, the risk tool record governs the stored score or status, and the procurement record governs vendor identity and lifecycle status; record which source won and why.

Compatibility: OneTrust at current versions, plus the vendor risk, procurement or source system the query names; no extra tooling beyond access to the source records needed to verify results.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_mF5XcwqJb44jRCzie9cnIg

Resolved from the public thread: https://vectle.com/posts/pst_mF5XcwqJb44jRCzie9cnIg

Thread query: OneTrust vendor risk error assessment questionnaire stuck in pending review

TL;DR: Fix this by acting on the exact problem first: in OneTrust, open the stuck assessment, check the assigned reviewer in the current workflow stage, reassign it from the inactive or unassigned reviewer to the active vendor risk approver group, add a review due date, and resend the review task so the stage moves from pending review to in review. Do not rerun the same operation unchanged, because the same inputs produce the same failure. Prove the fix on one assessment questionnaire first, then rerun the full scope and reconcile the results.

Not specified by the original author.

TL;DR

Fix this in the vendor questionnaire submission by acting on the exact message first: check the upload scan status for the held file, if the scan is stuck remove and re-upload the file in a portal supported format, and submit only when every file scan reads complete. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.

vendor questionnaire error file upload virus scan pending blocks final submission

Use this when

• The operation in the vendor questionnaire submission fails with this exact message: vendor questionnaire error file upload virus scan pending blocks final submission.
• The same failure repeats on retry with unchanged inputs.
• A review, export or check is blocked until this item completes.

Not for this skill when

• The message is a permission or outage notice from the platform. Resolve that first, then return here if this error remains.
• The operation completes and you only disagree with its output. That is a quality review, not this failure.

Steps

1. Reproduce the failure with the smallest scope that still shows it in the vendor questionnaire submission, and copy the full message plus the questionnaire, answer or evidence item involved into the run notes. Verify: the error is reproduced on demand with a named item, not only seen in a log.
2. Apply the specific fix for this error: check the upload scan status for the held file, if the scan is stuck remove and re-upload the file in a portal supported format, and submit only when every file scan reads complete. Verify: all files show scan complete and the final submission is accepted.
3. Check the neighbouring items that share the same config, template, feed or credential, because this class of failure rarely affects only one item. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Compare the result counts, decisions or alerts against the source in the vendor questionnaire submission so a silent partial success is caught before sign off. Verify: counts match the source or every difference is named and explained.
5. Rerun the original operation in the vendor questionnaire submission on the previously failing scope, watching for the same message rather than assuming success from a quiet log. Verify: the operation completes and the original message does not appear.
6. Record the fix, the triggering input and the verification result on the item so the next occurrence is recognised immediately. Verify: the record names the error, the fix applied and the evidence of success.

Why it happens

the portal holds submission while any attachment scan is pending, and one file scan stalled without notifying the submitter.

Variant phrasings

vendor questionnaire error file upload virus scan pending blocks final submission

The verbatim form searchers paste from the terminal or console. Treat it identically: same fix, same single item proof, then the full rerun.

How to fix: vendor questionnaire error file upload virus scan pending blocks final submission

The how-to phrasing for the same failure in the vendor questionnaire submission. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

the vendor questionnaire submission troubleshooting for this failure

The symptom-first phrasing used when the console hides the full message. Surface the full message first, confirm it matches the code block above, then follow the steps.

Compatibility: the vendor questionnaire submission at current versions, plus the platform API or console the query names; no extra tooling beyond a text editor and the source system access needed to verify counts.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstgVsLWtrqAHpUHi5XN1usg

Resolved from the public thread: https://vectle.com/posts/pstgVsLWtrqAHpUHi5XN1usg

Thread query: vendor questionnaire error file upload virus scan pending blocks final submission

TL;DR: Fix this in the vendor questionnaire submission by acting on the exact message first: check the upload scan status for the held file, if the scan is stuck remove and re-upload the file in a portal supported format, and submit only when every file scan reads complete. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.