Reading the results
Confidence and scoring
How sure the engine is about each finding, and what the score does and does not mean.
Why confidence is on every finding
Some things are facts. A response header is present or it is not. Other things are inferences — a technology guessed from the shape of a URL, a version derived from a fingerprint. Presenting those identically is how a scanner trains its reader to distrust all of it.
Confidence travels with the finding into exports, reports and the API, so a downstream system can filter on it too.
The score
The score summarises an asset's findings into a single number so a trend is visible. It is useful for direction and useless as a certificate.
It cannot mean 'secure', because the platform runs a fixed set of checks and a problem no check looks for cannot lower it. Read the findings; the score is for the graph.
What this does not do
A high score means the checks that ran found little. It is not evidence of a secure system and should never be presented as one.
Not checked is its own state
Where a check did not run, the interface says so rather than showing a dash. A dash reads as 'we looked and there was nothing', and telling somebody their origin has no WAF when the WAF check never ran is a claim they might act on.