After a scan
You have a port list from a discovery scan the scope allowed. Read the words in the file. Do not turn a port number into a vulnerability.
Open versus filtered
Open means something answered on that port. Filtered means you did not get a clear answer, often because a filter dropped the probe. Closed means the host said nothing is listening there. Write the word the report used.
Do not rewrite filtered as closed, or open as vulnerable. A missing answer is not the same as a closed door, and an answer is not a flaw.
A port number is not a vulnerability
A port number is a label. 443 often means HTTPS, until you have checked the service. The number comes from a list of common assignments. It is not proof of a version, a missing patch, or a way in.
A discovery scan asked which ports answered. It did not test those services. If the scope did not allow anything beyond that list, the list is the end of the work.
Which hosts to write down
Write the address, the name if the report has one, and the ports marked open. Note the time on the file and the scope it was run under. A host that is up with no open ports in the list is still a host if the question was what is on this network.
Skip addresses the scope did not include, even if they showed up because a range was wider than it should have been. Those lines are a scope problem. They are not inventory.
What you hand to someone else
Hand the file, the time, the scope sentence, and a short note: which hosts answered, which ports were open, and what you did not check. The findings page is the shape of that note. What failed is not the right heading if nothing failed. “These ports answered, and we did not test the services” is a complete note.
The Nmap workbench is how to read the states in the file you were allowed to create. The network workbench is what those ports carry once you have a capture or a log you are allowed to open. Neither page is a reason to probe further.