Your scanner report isn't the truth. The configuration is.

Every audit ends up with several reports about the same devices: a vulnerability scanner, a configuration reviewer, a cloud checker, and the spreadsheet a colleague wrote by hand. They overlap, they contradict each other, and each one misses something the others caught. The device's own configuration is the only thing that can settle the argument.

Why reports disagree

Each tool sees the device from a different angle. A network scanner looks from outside: open ports, banners, the version a service announces. A configuration reviewer reads settings. A manual review reflects what one person checked on one day. None of them is wrong to do that — but put the results side by side and you get the same issue described three different ways, findings that only one tool reports, and findings that are simply not true for this device.

The usual fix is a long meeting and a longer spreadsheet: someone opens the configuration and checks each finding by hand. It works, it's slow, and it rarely gets finished before the report is due.

What "checked against the configuration" means

For every finding, the question is the same: does this device's own configuration prove it, disprove it, or say nothing about it?

• Confirmed — the configuration shows the problem. You can point at the line.
• False positive — the configuration shows it isn't so: the setting is already correct, or the software version isn't affected. Again, you can point at the line.
• Mitigated or not applicable — the issue is real in principle, but the feature is switched off or something else already blocks it.
• Can't verify from a configuration — some things are only visible on the wire, like a certificate or a service banner. Honest reporting says so instead of guessing.
• Missed — the configuration shows a problem that none of the reports mentioned.

That last group is the uncomfortable one. A clean report from one tool doesn't mean a clean device; it means that tool didn't look there.

One list instead of four

Once each finding has a verdict, duplicates collapse: the same problem reported by several tools becomes one row that says who found it and who didn't. Disagreements stop being opinions — when one report says a setting passes and another says it fails, the configuration decides. What's left is a short list of real problems, each with its proof, plus a separate list of false positives you can hand back with evidence.

A fair score for each tool

Comparing tools on the same devices also tells you how much to trust each one: how many of its findings held up, how many didn't, and what it missed. Findings a configuration can't decide shouldn't count against a tool — that would only reward guessing.

Your own reports count too

Not every finding comes from a product. Internal reviews and consultant reports usually arrive as spreadsheets or tables in a document. They deserve the same treatment: read the table, check each line against the configuration, and fold it into the same combined view.