Findings & Evidence

Logical flaws

Seen by several tools

Under attack

One fix

Base-image blast radius

One flaw, several tools

Merged when the same application, weakness and window were reported by different tools. Open any row to see what each tool actually said.

What each tool is worth

How much of each feed was eventually judged a false positive. A static analyser is expected to be noisier than a pen tester.

False-positive rate by tool

Being probed right now

Open flaws that WAF telemetry shows are being attacked. No scanner knows what is attacked; no WAF knows what is vulnerable.

Weaknesses: what the scanner said, and what it means here

The gap between the two critical columns is effort spent in the wrong place.