What Is a Coverage-Qualified Assessment?

A coverage-qualified assessment is a threat verdict that states how much the system actually knows about the target — distinguishing 'known clean' from 'no data'. It prevents the dangerous default where absence of evidence is read as evidence of safety, which matters most when an AI agent acts autonomously.

Why 'no data' is not 'clean'

A reputation system that returns a low risk score for a host it has simply never seen is making a claim it cannot support. To a human that nuance is obvious; to an automated agent, a low number reads as a green light. The fix is to report coverage alongside the verdict: known-clean, structural-only, or no-data.

Coverage as a safety signal

Coverage tells the consumer how much to trust the verdict. A 'known clean' result is backed by observation; a 'no data' result is an explicit instruction to withhold confidence and gather more before acting. The distinction is the difference between a grounded decision and a guess.

Why agents need it

Autonomous agents act on what their tools return. Without coverage, a tool that says 'nothing found' silently becomes 'safe' — the exact gap that prompt-injection and tool-poisoning exploit. Coverage-qualification is the grounding primitive that closes it.