or, as annotated above, having the thing give true/false positivity determinations that get used by other systems that could then open up other systemic avenues of attack because holy shit security is a -systems- problem and you have to maintain an understanding of how all the parts work together to properly evaluate the impact of a given fucking vulnerability fucking surface.