Confirmed vs. Potential Vulnerabilities: Why the Distinction Drives Smarter Security Response

Security scanners classify vulnerabilities as either confirmed — verified through direct evidence — or potential, where a weakness is suspected but unproven, often due to backported patches that leave version numbers unchanged. The two categories demand different responses: confirmed findings require immediate remediation, while potential findings must first be investigated before action is taken. Mishandling potential vulnerabilities is a leading cause of vulnerability management failures, with teams either ignoring them and missing real risks or exhausting resources chasing unconfirmed alerts. The stakes are rising sharply, as over 30,000 new CVEs were recorded in 2025 and the median time-to-exploit has fallen to just five days. With nearly 29% of CISA's Known Exploited Vulnerabilities exploited on or before their CVE publication date, deferring investigation of potential findings is no longer a safe triage strategy.