How to read findings
How to tell if a CVE affects you
A version match is not “you are breached”. Here is how to read statuses and get to “affects us / doesn’t” without panic.
24 October 2026
probable — a match
Version, CPE/PURL or signature matched the vulnerability description. Signal to investigate, not proof of compromise.
confirmed — after a check
We raise the status only after a real safe external check (or when the fact is observed directly — e.g. expired SSL).
We never show “confirmed” without that check. Findings store a minimal fact (port, response type, version), not your data.
After confirmation — remediation
On Contour a finding gets an owner and deadline; overdue triggers an email, and a fix is followed by a re-check. Business adds SLA metrics and deeper API checks with consent.
Practice
Add a domain on Radar and read the feed for your perimeter — not a digest of every CVE on the internet.
Check my site for free