Guides

"Nothing found" is not the same as "we couldn't look"

A clean result can mean two very different things:

  • We looked, and there is nothing there. Good news.
  • We could not look. No news at all, displayed as good news.

They render almost identically, and the second one is dangerous precisely because it is reassuring. This page is how to tell them apart.

Why this happens

Some checks depend on outside sources — breach corpora, brand feeds, certificate logs, code search. When one of those is unavailable, the check records that it could not run. The finding list then has nothing to show, which looks exactly like a surface with nothing wrong on it.

This is not hypothetical. We have had a case where an intelligence provider was down for two days and Brand Protection reported no threats across the board. The estate had not improved. Nothing had been checked. The affected tenant's score went up, because the surface that would have lowered it had no data.

Before you trust a quiet result

Ask three questions:

  1. Did the check run? A surface that has never run is not the same as one that ran and found nothing. Check the last run time on the relevant surface.
  2. Is it plausible? Zero exposed code for a company with a large engineering team, or zero lookalikes for a well-known consumer brand, deserves a second look. Real zeroes happen, but they are rarer than they appear.
  3. Did it change suddenly? A surface that had findings last week and none this week, with no remediation in between, is far more likely to be a coverage problem than a cleanup.

Checks that depend on outside sources

These are the ones where "quiet" most often means "unavailable" rather than "clean":

  • Leaked credentials and breach data
  • Lookalike and impersonating domains
  • Exposed code and secrets in public repositories
  • Social and app-store impersonation

Your own infrastructure checks — DNS, mail posture, certificates, hosts — are observed directly and do not have this failure mode in the same way.

What we are doing about it

Surfacing coverage alongside results, so a factor that could not be checked says so on the page rather than rendering as a zero. Until that is everywhere, the questions above are the safeguard.

If you suspect a gap

Tell us which surface and when. We can see whether a source failed for your tenant, and that is a far quicker answer than re-running scans hoping the number changes.