Lead versus fact: why a scanner should refuse to guess

The difference between an observation and a confirmed fact, and why re-verifiable evidence is the only honest basis for a security finding.

A security tool that reports everything it suspects is not thorough; it is noisy, and noise is expensive. The discipline that makes findings useful is a refusal to promote a suspicion to a fact without an independent check.

Three states, not two

An observation is what a sensor or an agent produced. A lead is an observation that has been retained but not trusted. A fact is a lead that an independent, deterministic check has re-verified. The third state is the only one a report should present as true — and it should always be distinguishable from the second.

Re-verifiable or it did not happen

Confirmation should not depend on the tool that made the claim. A confirmed fact carries its raw evidence, a digest, its context, and its provenance, so that a compatible check can re-run later — offline, by someone else. If a finding cannot survive leaving the tool that produced it, it is not yet a fact.

The honest null result

The absence of a confirming signal is not proof that nothing is wrong. It means the tool does not hold enough evidence to confirm that something is. Reporting the two as the same thing is the most common way a security report misleads the person reading it.