The fastest way to get a vulnerability scanner uninstalled is to flood its user with findings that turn out to be nothing. Every scanner faces the same trade-off: heuristics aggressive enough to catch real issues will also flag benign server behavior, and heuristics conservative enough to stay quiet will miss real ones. Shieldome's answer isn't to pick a point on that trade-off and live with it - it's to run a second, independent pass over the findings before they ever reach a report.

Confirmed Findings Are Never Reviewed

The first thing to understand about Shieldome's AI review is what it doesn't touch. Every finding carries a confidence field set by the check itself - a finding is only marked confirmed when the evidence is conclusive by construction (a reflected payload that actually executed, a header that is actually absent, a file that actually returned 200). The AI confidence review step explicitly skips anything already marked confirmed - a language model doesn't get a vote on a fact the scanner already verified directly. It only reviews the findings sitting in the gap between "flagged" and "proven."

What the Review Actually Asks

For each high or critical finding that isn't already confirmed, a local model is given the finding's name, severity, and evidence, and asked two specific questions: is the evidence conclusive, or could this be benign server behavior - and is this finding type one that's commonly over-triggered by passive scanners in general (a known problem class, not a guess). It returns a false-positive likelihood from 0 to 100, not a binary verdict.

Estimate the false positive likelihood (0-100) for each finding.
Consider: is the evidence conclusive? Could this be a benign server behavior?
Is the finding type commonly over-triggered by passive scanners?

A score of 70 or higher downgrades the finding's severity by one tier and flags it ai_fp_risk: high with a short reason attached. A score between 40 and 69 is flagged medium risk but left at its original severity. Nothing is deleted or hidden at any score - a downgraded finding is still visible in the full report, just correctly weighted instead of sitting at the top of the pile next to something that's actually exploitable.

Ranking by Exploitability, Not Just Severity Label

A separate pass, triage scoring, handles a different problem: two findings can carry the same severity label while being wildly different in how urgently they need attention. The prompt behind this step states the principle directly - a medium-severity SQL injection indicator on a public login form is a more urgent problem than a critical-labeled version disclosure header, even though the label says otherwise. The model is asked to rank by real-world exploitability: does it need authentication, is it public-facing, does it chain with anything else found in the same scan.

A Second Opinion on Borderline Cases

For any single finding that still looks ambiguous after the pass above, there's a targeted second-opinion check that returns exactly one of three answers - likely_real, likely_fp, or uncertain - with a one-sentence reason. This is deliberately narrow in scope: it's a second read on one finding at a time, not a bulk reclassification, and "uncertain" is a valid and common answer rather than a forced choice between the other two.

Why the Order of Operations Matters

The reason this layering works is that it puts the deterministic check first and the probabilistic review second, never the other way around. If the model ran before the confidence label was assigned, an AI hallucination could suppress something that was actually proven. Because it only ever operates on the ambiguous middle ground, the worst case for a wrong AI judgment is a severity that's off by one tier on a finding that's still fully visible in the report - not a real vulnerability disappearing.

Seeing It on Your Own Scan

Every scan report shows the AI-adjusted severity alongside the original, with the reasoning attached to each downgraded finding. See our AI assistant documentation for the full breakdown of what runs where, or create a free account and run a scan to see which findings get flagged and why.