Coverage and Statuses

Coverage and statuses

Status	Meaning	Counts as secure?
PASS	The check ran and decided the control for the defined scope	only for that control
FAIL	Confirmed adverse observation	no
SUSPECTED	Heuristic signal without proof	no
INCONCLUSIVE	Ran but could not decide	no
BLOCKED	Missing tool, approval or human review	no
UNSUPPORTED	No implemented adapter (for example runtime profiles)	no
ERROR	The adapter failed	no
STALE	Inputs changed since the decision	no
NOT_APPLICABLE	No matching assets; automatic reason shown	excluded from the denominator

Decisive coverage = (PASS + FAIL) / applicable controls. When files changed after the last scan, decisive coverage is reported as zero until you re-scan. Coverage is never the percentage of vulnerabilities found.

NOT_APPLICABLE is decided automatically from the inventory (for example no Android manifest means K controls are N/A). Review these decisions: a missed asset is an inventory gap, not proof of absence.

Edges have their own status derived from linked controls: any FAIL makes the edge FAIL; any undecided control makes it BLOCKED; only all PASS makes it PASS. A domain passing on its own never hides a failed edge.