Confirmed, firm and suspected

Every finding has a confidence alongside its severity. It says how directly RevoSecure observed the problem.

In lists, only non-confirmed findings show a confidence badge, so Firm and Suspected stand out.

Why version banners are only suspected

A website might send Server: Apache/2.4.52. That string names the upstream version, but Linux distributions back-port security fixes without changing it: Ubuntu's 2.4.52-1ubuntu4.x can be fully patched while still announcing 2.4.52. So a CVE matched from a banner may not apply. RevoSecure therefore:

• marks such findings suspected;
• never rates them critical;
• lowers their risk score by 8 points.

The same applies on the Vulnerabilities page, where distribution packages RevoSecure can't judge are shown as possibly affected.

What to do with a suspected finding

1. Check the actual package or build on the system (for example apt changelog apache2 or rpm -q --changelog), or ask the hosting provider.
2. If it's patched, mark the finding False positive with a short reason.
3. If it isn't, apply the vendor's or distribution's security update. The finding resolves after the next assessment that no longer sees the issue.

Confidence elsewhere

• Internal discovery only establishes that a TCP port answered. It never confirms a service, product or vulnerability, so discovery findings are tentative review items.
• Dark web code-search hits for passwords, keys or tokens are suspected: the value is redacted and needs a human to check.
• Missing data never confirms anything. A check that errored or was skipped resolves nothing and is shown as a coverage gap, not a pass.