A Clean Scan Can Mean the Scanner Never Ran

Zero findings is a result only when I can prove the checks responsible for that result actually completed.

That sounds obvious, but dashboards flatten very different states into the same reassuring number. A target can have no verified findings because the tested surface was clean, because a check was not applicable, because the host was unreachable, or because a scanner failed before producing output.

Question

What evidence is required before RedBlue can present a scan with no findings as meaningful rather than merely empty?

Method

I examined three changes made on 30 June: reachability-aware priority, scanner-dropout visibility, and the revised risk score. I looked for the distinction between target state, scanner state, and finding state. The commit metadata is preserved in a sanitised evidence record.

The review is about representation and decision quality. It does not rerun the historical scans or independently measure scanner accuracy.

Evidence

Reachability-aware priority added context that severity alone could not supply. An exposed, reachable service and an unreachable candidate do not create the same immediate decision, even when they share a vulnerability label.

The scanner-dropout work addressed the more basic ambiguity. RedBlue began distinguishing a completed zero-yield check from one that did not run successfully. That prevents an execution failure from lowering apparent risk.

The risk-score revision also limited scoring to verified evidence, weighted confirmation, and avoided easy saturation. Taken together, the changes moved the platform away from counting raw scanner output and towards explaining how much confidence a result deserved.

Finding

Every “clean” statement needs a denominator. Which scanners were expected? Which completed? Which reached the target? Which were not applicable? Which failed? Only after those questions are answered does zero become useful evidence.

This is one of the places where honest uncertainty improves the product. A visible dropout may feel worse than a clean dashboard, but it gives an operator something actionable: repair the check, rerun it, or narrow the claim.

Limitations

Execution evidence does not prove that a scanner can detect every relevant exposure. A completed check can still have blind spots, configuration limits, or false negatives. The private implementation cannot be independently audited from this public record.

Risk scoring is also a prioritisation aid, not a verdict. Asset criticality, ownership, compensating controls, and local business context remain outside what these three commits can establish.