Overview
Every candidate finding — from a scanner or manual observation — must be validated before it is trusted or reported. This lesson covers validating vulnerabilities.
Learning objectives
- Explain why validation is essential.
- Describe how findings are validated safely.
- Connect validation to accurate, credible results.
Core concept
Validation is confirming that a candidate finding is a genuine, exploitable-in-principle vulnerability — not a false positive, a misinterpretation, or a non-issue. It means verifying the condition actually holds and that the described impact is real, ideally through safe confirmation (demonstrating the issue exists without causing harm). Only validated findings, with confirmed impact, belong in the results. Validation is what separates a trustworthy assessment from a raw list of unconfirmed alerts.
How it works
For each candidate finding, the tester confirms it against the actual target: does the vulnerable condition truly exist (e.g. is the service genuinely the reported version and affected)? Is the impact real? This is done with non-destructive confirmation appropriate to the engagement — enough to prove the issue, never causing damage or exceeding scope. Findings that cannot be confirmed, or that turn out to be expected/patched, are discarded or downgraded. Validation may also refine the finding's details and severity based on what is actually confirmed. The result is an accurate finding set.
Practical example
A scanner flags a service as vulnerable to a known issue. The tester validates by safely confirming whether the service is truly the affected version and behaves as the finding claims — without exploiting it destructively. If confirmed, it becomes a validated finding with real impact; if the service turns out to be patched (a false positive by banner), it is discarded. Validation ensured only the real issue is carried forward, protecting the report's credibility.
Cybersecurity relevance
Validation is central to a credible, accurate assessment: unvalidated findings (especially scanner false positives) waste remediation effort and erode trust, while confirming impact ensures priorities are real. Safe, non-destructive validation reflects the "do no harm" ethic — proving issues without causing damage or exceeding scope. This mirrors the validation discipline in the web-assessment module and feeds accurate severity rating and remediation. Distinguishing real, confirmed vulnerabilities from candidates is a core professional competency.
Common mistakes
- Reporting unvalidated candidate findings, including false positives.
- Validating destructively or beyond scope instead of using safe confirmation.
- Not refining severity/details based on what validation actually confirmed.
Key takeaways
- Validation confirms a candidate finding is a genuine vulnerability with real impact, using safe, non-destructive confirmation within scope.
- Only validated findings belong in results; unconfirmed or patched candidates are discarded or downgraded.
- Validation ensures accurate, credible results and reflects the "do no harm" ethic; it feeds severity rating and remediation.
Check your understanding
- Why must candidate findings be validated before being reported?
- What does "safe, non-destructive" validation mean, and why does it matter?