What zero-trust means for a scanner

Why ZTVS attaches evidence to every finding, and what that rules out.

Unatazama toleo 0.0.1. Toleo jipya zaidi ni 0.0.2.

Tazama 0.0.2

"Zero trust" is usually said about networks: authenticate every request, trust no segment, assume the perimeter has already failed. Applied to vulnerability scanning it means something specific and slightly awkward.

The claim a scanner usually makes#

A conventional scanner reads a manifest — a lockfile, an OS package database, an SBOM someone generated in CI last quarter — and reports on what the manifest says. The output looks factual. It is actually a claim about a claim: the scanner is telling you what a file told it.

That is fine right up until the manifest and the artefact disagree, which they do constantly. A dependency vendored by hand. A binary patched in place. A base image rebuilt under the same tag.

What ZTVS does instead#

Every finding carries the evidence that produced it: which source, which file, which line or which layer digest. Not as a debugging aid — as the finding's justification.

This has a consequence people find annoying at first: ZTVS will report fewer things than a manifest scanner, because it declines to report what it cannot evidence. A package listed in a lockfile but absent from the filesystem is not a finding. It is a discrepancy, and it is reported as one.

What this does not give you#

Being precise about the boundary, because a security tool that overstates its guarantees is worse than one that does nothing:

  • ZTVS verifies what is present. It does not verify that what is present is what you intended.
  • Evidence proves the scanner's reasoning. It does not prove the scanner ran, or ran unmodified. That gap is what attestation addresses, and 0.0.1 does not have it.
  • Advisory data is still someone else's claim. ZTVS records which database and which snapshot it used, so the claim is at least attributable.

Why the strictness is the feature#

A scan you cannot argue with is worth more than a scan with a longer list. When a finding is disputed — and they are disputed constantly, usually by the team who owns the service — the argument should be about the evidence, not about whether the scanner is trustworthy.