How we know we actually looked

The hardest question a client can ask a security consultancy is not what did you find. It is how do I know you looked.

Most of the industry answers that with reputation. We would rather answer it with a document.

The failure mode nobody reports

A static analyser exits 0, prints a well-formed summary, and reports a handful of findings. It looks like a completed run. In one case we hit, it had analysed 27% of the codebase — the rest failed to resolve imports, and the failures were counted in a field nobody reads.

The same shape recurs everywhere:

A live-state query returns "no privileged accounts" — because the endpoint was rejecting the request's user agent, not because the set was empty.
A shell loop reports 0 differing files across eight pairs — because word-splitting behaved differently under zsh. Twenty-seven files differed.
A fuzzing campaign reports every property passing — while a missing setup step made the target silently unreachable, so the properties were vacuous.

Every one of these looks exactly like good news. That is what makes the class dangerous: a broken harness does not error, it returns emptiness, and emptiness is indistinguishable from clean.

Positive controls

The fix is old and comes from the lab, not from software:

Before a zero is allowed to mean anything, run a probe you are
certain returns non-empty through the SAME code path.
 
  control returns data  ->  the zero is a finding about the target
  control returns empty ->  the harness is broken, not the target clean

A negative control matters too — something you know is false, to catch a decoder that says yes to everything.

What this changes about the report

Once you take controls seriously, two things follow.

Negative results become deliverables. "We looked here, here is what we tried, here is the control that proves the tooling was working, and it is clean" is worth money to someone making a ship decision. Almost nobody provides it.

Coverage becomes auditable. The engagement ships a ledger: every surface crossed against every vulnerability class, a verdict per cell, and the evidence behind each verdict — including the cells that came back clean and how we know.

You can check that. You cannot check intuition.