Home / Help centre / Results & findings
Results & findings
What's the difference between Confirmed, Likely and Unconfirmed?
Confirmed, Likely and Unconfirmed are the Status of a finding. They show how strongly the scan proved it. Confirmed has the strongest proof, such as a captured request and response. Likely is well supported but less proven. Unconfirmed is the weakest grade.
The short version
The Status line on a finding says how well it was proven. It is not the same as severity or confidence.
How it works in Cyberlop
The exploitation phase tries to demonstrate each hypothesis against the live target, using a real browser. It captures the HTTP request, the response, the payload and, where relevant, a screenshot. Findings are then graded on how strongly they were proven.
| Status | Reads as |
|---|---|
| Confirmed | Proven, with evidence you can read on the Evidence tab |
| Likely | Supported by the analysis, but not fully shown |
| Unconfirmed | Raised, with the least proof |
You will see Confirmed and Likely most often. White-box findings that come from reading code can be Likely when the live proof was not captured.
If a profile runs without the exploitation phase, the scan is analysis only and cannot gather live proof. Expect fewer Confirmed findings then.
When two findings merge, the version with the most evidence and the strongest status wins.
What to do next
Read Confirmed findings first. The request, response and repro steps let you check them in minutes. Treat Likely findings as leads. Open the Evidence tab and look at what is missing.
Keep the three ideas apart: Status is proof, Confidence is how sure the scan is, Severity is impact. Read status versus triage and what to do with findings that are not proven. The glossary page on evidence of exploitation adds context.
A short rule of thumb helps new team members: trust a Confirmed finding after a quick look at the evidence, and treat a Likely one as a lead that needs a person to check it before work starts. Simple, and it works.
Related questions
- What's the difference between a finding's Status and its Triage state?
- Why aren't any of my findings marked Confirmed?
- How do I filter findings by confidence?
- How do I see the HTTP request and response that proved a finding?
- Why doesn't my finding have a screenshot?
How to read a finding in Cyberlop: Summary and Evidence
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.