The Scanner Never Loaded Its New Threat Feed
The updater downloaded a threat feed, but periodic scans never read it. A quiet report says little when the scanner never loaded its evidence.
I once found a gap in ai-agent-audit, the tool I built to check agents installed on a machine.
Its updater downloaded a list of suspicious addresses and files, then saved the list to disk. The periodic scans never read that file.
The download worked. The check that needed it carried on with its old list.
I have found a quiet security report means very little if the scanner never loaded its evidence.
The file-loading bug was fixed that day. The downloaded feed contained 5,493 indicators of several kinds. One set, holding IP addresses associated with systems that direct compromised machines, grew from five entries to 1,519. The repair record also showed a check matching an address from the feed.
I could see the new data load, and one known address matched. It didn't prove that every indicator type was handled correctly, that the feed wouldn't create false alarms, or that the scanner could recognize a threat absent from its lists.
The tool has other checks with similar limits.
An old credential gives me a reason to consider replacing it. Its birthday can't tell me whether somebody stole it.
For critical files, the tool also watches configuration and permission changes. A changed permission tells me which file to inspect. I still have to find out whether somebody authorized it.
Installed agent extensions get a different check. The scanner looks for suspicious patterns it already knows. When it finds one, I inspect the extension. When it finds nothing, I know only that those patterns weren't there.
I want the report to keep those checks separate.
I also need to know when a check never got that far. The tool distinguishes DEGRADED, an assessment missing visibility or configuration evidence, from SKIPPED, a check that doesn't apply to the detected environment. Missing evidence deserves investigation. An inapplicable check doesn't need more access just to make its label disappear.
Neither state means the machine passed a security review. I keep the state and the missing evidence in the report.
Sources: ai-agent-audit's documented checks; the indicator-feed repair.