Lab

A vulnerability scanner that shows its work, and admits what it didn't see.

A scan that couldn't see shouldn't look like a clean scan. I'm building a scanner that answers a harder question: does this vulnerability actually apply to this server, and what's the evidence? When the facts are missing or stale, it says "not assessed" instead of "clean." Scanner-check coverage for NIST 800-171 / CMMC Level 2 is reported as checks satisfied, gap, or not assessed, never inflated.

Principles

Unknown is an answer. A scan that couldn't see is reported as not assessed, never as clean.
Every verdict shows its evidence. "Not affected" comes with the reason, not just a missing finding.
Coverage is never inflated. Controls a scanner can't assess are labelled that way.

Illustrative

EXAMPLE-0001
  verdict : [ok] NOT AFFECTED
  basis   : vendor fix included in installed build

EXAMPLE-0002
  verdict : [?] NOT ASSESSED
  reason  : package inventory incomplete
  note    : this is not a clean result

Control evidence (synthetic set; scanner-assessable portion only)
  CTRL-A  [ok] checks satisfied  scanner checks ran, no open findings
          (not a whole-control attestation)
  CTRL-B  [?] not assessed       policy can't be evaluated from observed state
  CTRL-C  [!] GAP                1 open finding cites this control

Illustrative. Synthetic test fixtures only; no customer or lab-run data.

Status

In private development.

Not available yet. If you run Linux fleets under compliance pressure and want to help shape it as a design partner, tell me about your environment. I'll reach out when there's something real to try.

Become a design partner