Uncertainty as recorded state
Every scanner has unknowns. Stella Ops shows you yours.
When evidence cannot confirm a finding reachable or unreachable, most tools drop it from view. Stella Ops records it as an explicit unknown — banded, aged, and visible until evidence resolves it.
NOT OBSERVED is not not-vulnerable.
A gap is a tracked finding with an owner and a review window, not an empty field.
The model: uncertainty is a state, not a gap
An unknown is a finding the analysis could not confirm reachable or unreachable with the evidence collected so far. That is a statement about the evidence, not about the vulnerability — so it gets a state, a rank, and a history. ReachabilityAnalysis that proves whether vulnerable code is actually called by your application — filtering out false positives from scanner noise
Unknowns stay visible
Findings that cannot be confirmed reachable or unreachable stay in the working set as unknowns instead of silently dropping out. They rank lower than confirmed blockers; they never disappear.
Bands rank the triage queue
- HOT
- WARM
- COLD
- RESOLVED
Unknowns are scored into bands by two factors: how uncertain a finding is and how much exploit pressure sits behind it. Banding changes ranking and emphasis, never the data. Each band carries its own rescan cadence, and RESOLVED closes the loop when evidence arrives.
Exploit-pressure feeds: KEVKnown Exploited Vulnerabilities - CISA's catalog of vulnerabilities actively exploited in the wild EPSSExploit Prediction Scoring System - a probability score (0-100%) predicting how likely a vulnerability is to be exploited in the wild
KEV and EPSS are live risk-scoring inputs across the product. Wiring them into the unknowns exploit-pressure factor is planned, not shipped in v1.0-RC1.
Aging and decay are deliberate
Unknowns age against review windows rather than lingering untouched. Every state change is recorded, not overwritten — what was unknown, for how long, and what resolved it stays on the record.
Policy can budget unknowns
A gate can require the unknown count to be inspected or bounded rather than pretending it is zero. How much uncertainty an environment tolerates becomes an explicit policy choice instead of an accident of tooling.
The proof surface: the Exposure screen
Seven findings enter the working set below. One blocks — reachable and unfixed. The rest hold NOT OBSERVED states: still in the set, ranked lower, never hidden.
“What did you know, and when?”
That is the question an audit asks. A tool that hides unknowns cannot answer it honestly: its record shows only what was confirmed, and the uncertain findings left no trace. Stella Ops answers with the recorded state itself — which findings were unknown, which band they sat in, when they were reviewed, and what evidence moved them to RESOLVED.
Those state transitions are part of the evidence a decision carries, so the answer is a record you can hand over, not a reconstruction. Decision CapsuleA signed, exportable evidence bundle that seals every input and output of a release decision for offline audit and deterministic replay
Where this stands against other scanners
In our source review of Trivy v0.55, Grype v0.80, and Snyk CLI v1.1292, none of the three tracked unknowns as a systematic state with escalation workflows. Findings without confirming evidence are reported flat or filtered out — without bands, review windows, or a recorded resolution path.
This statement is based on our audit of those specific versions. Later releases may change it — verify against the release you run.
Where unknowns come from — and where they go
Unknowns are produced by analysis, carried in evidence, and watched in the estate. Each surface keeps the same rule: record the state, never fake certainty.
Reachability
Where unknowns are born: findings the static, binary, and runtime evidence layers cannot confirm reachable or unreachable.
Evidence
Unknown states and their transitions are sealed into the decision's evidence bundle, so the uncertainty at decision time is replayable later.
Estate
The Watch stage handles a different unknown: a running digest that is not an approved/deployed digest is flagged, not assumed fine.