How Sentinel was measured.
Detection and execution measured against an estate with known vulnerabilities, from external and internal vantage points.
- Target hosts
- 14
- Target addresses
- 15
- Planted issues
- 63
- Scored issues
- 59
The estate combines real software and explicitly emulated services. Its 15 addresses represent 14 hosts, including 1 host on both networks. All runs used 3 external and 12 internal addresses without supplied credentials. The 4 credential dependent issues are excluded from the score.
Detection results
Every row is scored against the same 59 issues. The comparison runs from 30 October are retained alongside the Sentinel run from 4 November.
| Run / date | Found | Partial | Missed | Weighted recall | Active execution | Decoys rejected |
|---|---|---|---|---|---|---|
| Sentinel + AI review4 Nov 2026 | 54 | 2 | 3 | 93.22% | 13m 58s | 6 / 7 |
| Sentinel scanner4 Nov 2026 | 48 | 7 | 4 | 87.29% | 11m 22s | 7 / 7 |
| Market leader30 Oct 2026 | 42 | 4 | 13 | 74.58% | 50m 22s | 6 / 7 |
| Open Source Scanner30 Oct 2026 | 37 | 7 | 15 | 68.64% | 34m 35s | 6 / 7 |
How a result earns its score
Each issue has a predefined evidence rule. A finding must match the correct host and, where specified, the port. A full match earns 1 point; a partial match earns 0.5; a miss earns 0.
(54 + 0.5 × 2) ÷ 59 × 100 = 93.22%
The weighting gives partial credit, with equal weight for each issue regardless of severity. The separate any detection rate is 56 / 59 = 94.92%.
What the AI review changed
The review examined the scanner’s collected evidence. It moved 5 partial detections and 1 missed detection to found. The 12 accepted review records therefore improved the result for 6 scored issues.
- Before review
- 48 found · 7 partial · 4 missed
- After review
- 54 found · 2 partial · 3 missed
Execution time and elapsed time
The animation compares recorded active execution. Sentinel’s combined figure adds scanning and AI review. The review started later, so the full interval also includes a wait.
- Scanning
- 11m 22s
- Wait before review
- 1h 56m 35s
- AI review
- 2m 36s
- Combined active execution
- 13m 58s
- Start to combined result
- 2h 10m 33s
The scan ran from 19:47:26 to 19:58:48 UTC. Review ran from 21:55:22.812 to 21:57:59.064 UTC. Durations are rounded to whole seconds. The comparison runs took 50m 22s and 34m 35s respectively on 30 October.
Recorded configuration
Profiles and concurrency are part of the measurement. These are the settings retained for the selected runs.
Sentinel scanner
- Profile
- Aggressive; 4 concurrent hosts
- Ports
- TCP 1–65535, SYN scan; top 1000 UDP ports
- Checks
- Default credential testing enabled; no supplied credentials
- Engines
- Nmap, Nuclei, testssl.sh and Sentinel module checks
AI review
- Model
- Mythos 5.1; 4 calls
- Input
- Collected scanner evidence; product prompt and evidence gate
- Outcome
- 12 accepted records; 6 scored issues improved
Market leader
- Profile
- Tuned scan without supplied credentials; 22 settings verified
- Ports
- TCP 1–65535; UDP 1–1024
- Checks
- Safe and thorough tests; web tests and default credential attempts enabled
- Concurrency limits
- 30 hosts per scan; 4 checks per host
Open Source Scanner
- Profile
- Network scan without supplied credentials
- Ports
- All TCP ports; top 100 UDP ports
- Host discovery
- Targets treated as alive
Scanner host
The runner setup records a shared scanner server with 4 vCPU and 8 GB RAM. Scanners ran separately. Per run CPU utilisation and peak memory are not included in the retained result records.
Decoys and execution errors
The 7 decoys are preset traps scored independently from recall. The table reports rejection of those specific traps.
- Sentinel scanner
- Rejected all 7 decoys. The scan logged 3 detector batch errors with no applicable templates.
- Sentinel + AI review
- Rejected 6 of 7. A plain HTTP finding quoted a fake software banner, matching the existing trap rule. It did not assert the corresponding software vulnerability. The recorded trap result remains 6 of 7.
- Market leader
- Rejected 6 of 7. Its banner trap result is an inventory identity mismatch, rather than a remote code execution finding.
- Open Source Scanner
- Rejected 6 of 7. Its raw report contains 5 timeout errors, including probes for 2 ports marked closed. These errors leave gaps in negative coverage.
Records and reproducibility
The retained material includes ground truth, evidence rules, normalised findings, raw reports, source references and container image identities. Recalculation on 5 November reproduced all 4 score rows; all 40 recorded input and raw source hashes matched.
- Sentinel source
- 810bd1e26c7b0060ca103768de25da37f1afe34b
- Custom detector set
- f2a8d23f3427 · 42 templates
- Estate checks
- 57 external and 71 internal checks passed before and after the run
Upstream detector templates refreshed per scan; the exact runtime revision was not retained. Replaying the scoring uses the saved findings and evidence rules. An exact detector rerun also requires that missing revision. This comparison uses 1 selected run per scanner. No confidence interval was calculated.
SHA-256 fingerprints
- Ground truth
a687c6737d12540479304b34b2bd4d44b4d4879a9444663afd8cff9213edf902- Scoring script
e2e0c175f5e628ceda25a0478a5339498feff98b1ae80078c51b8b17a7458093- Combined Sentinel findings
52362d5030ca2eb86ba166c829aef4dfe70229497261dbec2ddb50e01c616fe8
About the comparison label
“Market leader” refers to the comparison vendor’s worldwide market share in device vulnerability and exposure management, based on IDC’s August 2026 report as quoted in its September statement and October filing. It describes category market share, not the tested scanner’s performance rank.