Cybersecurity analysts interpreting reports often perform their own investigations to confirm the presence and severity of vulnerabilities. These investigations may include the *use of external data sources* that supply additional information valuable to the analysis. ### False Positives Vulnerability scanners aren't foolproof. Scanners do sometimes make mistakes for a variety of reasons. The scanner might not have sufficient access to the target system to confirm a vulnerability, or it might simply have an error in a plug-in that generates an erroneous vulnerability report. When a scanner reports a vulnerability that does not exist, this is known as a *false positive error*. Cybersecurity analysts **should confirm each vulnerability** reported by a scanner. In some cases, this may be as simple as verifying that a patch is missing or an operating system is outdated. In other cases, verifying a vulnerability requires a complex manual process that simulates an exploit. ### Reconciling Scan Results with Other Data Sources Vulnerability scans should never take place in a vacuum. Cybersecurity analysts interpreting these reports should also turn to other sources of security information as they perform their analysis. Valuable information sources for this process include the following: - *Log reviews* from servers, applications, network devices, and other sources that might contain information about possible attempts to exploit detected vulnerabilities - *Security information and event management* ([[Security Information and Event Management|SIEM]]) systems that correlate log entries from multiple sources and provide actionable intelligence - *Configuration management* systems that provide information on the operating system and applications installed on a system