Three products returned near-zero counts in the same measurement session, and the reasons differ enough that reading them together is more useful than reading each alone.
The numbers
The queries were run on 5 October 2026 with sub_type set to all and a page size of one. A query for title="ScyllaDB" returned 43 matches, and body="ScyllaDB" returned 1 match. A query for title="Debezium" returned 170 matches, and body="Debezium" returned 0 matches. A query for app="Falco" returned 4 matches, and body="Falco" returned 3 matches. An application fingerprint query for ScyllaDB and Debezium returned zero in both cases.
Three different reasons for a small number
ScyllaDB is a database that speaks its own protocol and ships no default browser interface. Its counts are small because there is almost nothing to match, not because the product is unused. The same pattern appears with other database servers.
Debezium is a change data capture component that runs inside Kafka Connect. It is a plugin rather than a standalone service, so it does not present its own network listener in a typical deployment. A title count of 170 reflects documentation, dashboards and management pages that reference the project name.
Falco is a runtime security agent that runs on hosts and in Kubernetes clusters. It is designed not to expose a network service, so an application fingerprint match is close to impossible for the agent itself. The four matches almost certainly point to something else that happens to share the name, which is a reminder that a fingerprint query can produce false associations with a common word.
What this tells a defender
The three results share a conclusion. A product that does not present a network interface will not appear in exposure data, and the absence of a result is not a security statement about the deployment.
That matters because it changes which question the data can answer. For a database or an agent, external measurement cannot substitute for a configuration review. For a component that does present an interface, external measurement is a starting point for triage.
How to use a near-zero result
Two practices make a small result useful. Record the query string and the matching mode, because a zero from a title query and a zero from a fingerprint query carry different meanings. Treat the small counts as a review list. Forty-three title matches and four fingerprint matches are small enough to examine individually, which is not true of a count in the thousands.
The broader reading
A measurement programme that only reports large numbers will miss the tier of software that is deployed widely and configured to stay quiet. That tier includes the data stores, the sidecar agents and the plugins that run inside other services. It is also the tier where a compromise is hardest to detect from outside, which is a reason to measure it internally rather than only from a scanning platform.
These counts describe what ZoomEye can observe on the public internet as of the collection date. A zero or a near-zero does not indicate that a product is absent from an environment.
Top comments (0)