Interpret and validate vulnerability assessment results

Scanner output is a lead. Match the detected service, version method, evidence, and affected configuration to authoritative asset facts. Banner versions can be hidden, backported, proxied, or stale. A package number alone may not reflect vendor fixes that were applied without changing the upstream version string.

Validation should be non-destructive where possible: confirm listening service, installed package advisory, configuration, and compensating controls. Record false positives with the evidence and expiry condition that justify suppression; otherwise a permanent exception can hide a later real exposure.

Scanner severity is not the same as local risk. Read detection method, confidence, affected endpoint, authentication status, and evidence. A finding on a decommissioned address may reveal stale inventory; a finding behind an unreachable path may still matter to internal users; a finding on a public service changes exposure.

Configuration results also need context. A missing header on an API response may be irrelevant if the control applies only to browser rendering, while anonymous write access to an object store has direct effect. Translate tool labels into the actual unwanted action an attacker or user could perform.

Angry IP Scanner and Masscan can discover responsive hosts or ports, with very different interfaces and scale, but no response can mean filtering, rate loss, or downtime. Nmap adds service probes; MSF can validate an exploit path only when explicitly authorized. Maltego and Recon-ng collect and relate external information whose provenance still needs review.

Burp Suite and ZAP observe and modify web requests through a proxy and support automated checks; Nikto focuses on web-server files and configurations. A finding must retain route, role, parameter, request, response, authentication, tool version, and safe reproduction. A tool name or severity is not the vulnerability.

Nessus and OpenVAS use broad plugin families; Nuclei executes template-defined checks. Read the proof, authentication status, target, and detection method before trusting a title. Cloud tools observe different layers: ScoutSuite/Prowler review provider configuration, Trivy scans artifacts and IaC, and Checkov evaluates IaC before deployment. Repository state and running state can differ.

Atomic Red Team supplies small technique-oriented tests; Caldera can orchestrate multi-step adversary emulation. Both require authorization, platform prerequisites, safety boundaries, telemetry expectations, cleanup, and restoration. A successful test means the action ran; detection and prevention are separate measured outcomes.

Angry IP Scanner: Fetcher columns report results from configured probes: response time, reverse name, and observed ports. They do not assess every vulnerability or certificate property. Masscan: Each output row states protocol, port, address, and observation time. Fast discovery finds candidate endpoints; confirm service and missing-port claims with a bounded follow-up. Nmap: open means an application accepted a connection, closed means a reachable host rejected it, and filtered means probes were blocked or unanswered. Service labels are identification hints. MSF: RHOSTS is the target setting and Check: Detected is a module check result. With exploitation not attempted and no session shown, do not claim shell access.

For these tools, first name the exact field or operation, then translate only that field into a claim. Preserve the raw output and collection scope. Confirm inferred identity, behavior, exposure, prevention, or remediation with another evidence source or a bounded retest.

Maltego: Edges show transform-produced relationships and nodes show entities. The graph does not change infrastructure or prove common control; retain transform source and collection time. Recon-ng: workspace scopes stored records, module names the collection step, and source states provenance. 'inserted' describes database storage, not exploitation or current reachability. Burp Suite: Issue, Severity, Confidence, Request, and Response evidence describe the scanner's finding. Reflected text still needs HTML/JavaScript context and encoding review to establish execution. ZAP: Risk estimates impact, Confidence estimates finding certainty, and URL identifies the tested response. Alert 10020-1 is raised when a response has neither a Content-Security-Policy frame-ancestors directive nor an X-Frame-Options header. Check neighboring routes before deciding scope or remediation.

For these tools, first name the exact field or operation, then translate only that field into a claim. Preserve the raw output and collection scope. Confirm inferred identity, behavior, exposure, prevention, or remediation with another evidence source or a bounded retest.

Nikto: Each line beginning with + reports an observed header, banner, or path. Older Nikto output prefixed findings with OSVDB reference numbers; current releases no longer print them. A banner can be misleading, and no line is a severity score. Nessus: Plugin ID names the test, Output records the observed protocol result, and Severity ranks the finding. The certificate CN is separate evidence from accepted TLS versions. Nuclei: The bracketed fields are the template ID, protocol, and severity, followed by the matched URL. In JSON output matcher-status is a Boolean: true means the response satisfied the template's match conditions. It is not an HTTP status code and does not show authenticated access. OpenVAS: Severity is the CVSS-based score from 0.0 to 10.0 that Greenbone assigns to the result, and 5.3 falls in the Medium band. QoD, quality of detection, expresses how reliable the detection method is. Neither field is exploitation probability; validate the algorithms negotiated on the named port.

For these tools, first name the exact field or operation, then translate only that field into a claim. Preserve the raw output and collection scope. Confirm inferred identity, behavior, exposure, prevention, or remediation with another evidence source or a bounded retest.

ScoutSuite: flagged and checked are counts within the assessed cloud scope; resources lists affected objects. A logging finding does not say buckets are public or data was stolen. Prowler: status=FAIL says the named control check failed for resource; status_extended explains the tested condition. Severity is control priority, not proof of stolen credentials. Trivy: The explicitly synthetic LAB-VULN row teaches Package, Installed, Fixed, and Severity without asserting a real CVE mapping. Scanner output does not prove runtime exploitation or exposure. Checkov: Check ID names policy, resource identifies IaC object, and the line range locates source code. A failed static check neither changes state nor proves deployment.

For these tools, first name the exact field or operation, then translate only that field into a claim. Preserve the raw output and collection scope. Confirm inferred identity, behavior, exposure, prevention, or remediation with another evidence source or a bounded retest.

Atomic Red Team: Technique and Test identify the emulation, status reports command completion, cleanup records cleanup, and telemetry_event is the detection artifact to seek. Caldera: Operation scopes the exercise, Agent is the controlled endpoint, Ability is one action, and Link status records execution. Detection=none is a test gap, not universal undetectability.

For these tools, first name the exact field or operation, then translate only that field into a claim. Preserve the raw output and collection scope. Confirm inferred identity, behavior, exposure, prevention, or remediation with another evidence source or a bounded retest.