A host-level security scanner reported a malicious file on a site we maintain. Hours earlier, an independent integrity check had reported the same site clean.
That contradiction is the interesting part. Two checks, two answers, and no way to tell from the outside which one was wrong.
Two independent read-only layers were run. Full platform integrity verification: every core file compared against published checksums, plugin code compared where checksums exist, administrator accounts enumerated, drop-in files checked, themes verified. And a credential-free census of every script the site actually serves to a browser, compared byte-for-byte against a baseline from an earlier investigation and scanned for obfuscation patterns.
Together these ruled out the realistic worst case — an actively exfiltrating checkout skimmer. They did not produce an all-clear, and we said so at the time: the flagged file was necessarily in a blind spot, since many commercial plugins publish no checksums and skip verification entirely.
The flagged file was our own security tooling. A monitoring component we had installed on that site ourselves.
A prior review had looked directly at that file and dismissed it
Recorded, in writing, as the expected monitoring plugin. The investigation hunted for an attacker's artifact and treated our own tooling as trusted by definition. Every hypothesis was tested except the one that turned out to be true.
An integrity check's trusted set is part of its blind spot
Any verification system reasoning from its own inventory can only find things outside that inventory. It will never flag itself, and never flag anything it was told to expect. That is not a bug in the tool — it is a property of the design, and it is invisible until something outside the system disagrees with it.
The rule we adopted
For anything automated that makes a judgement, the evidence that it worked has to come from outside the thing being checked. A check that reasons only from its own inventory is not a check. It is a mirror.
Why this applies to you
Every business running monitoring, alerting, or automated verification has this exposure. The question is not whether the tool reports green. It is what would have to be true for the tool to report green while being wrong — and whether anything in the system is positioned to notice. Most organisations have never asked.
Client, vendor, product and industry details are removed, along with any figures belonging to the client. The technical detail is unchanged. This shows how we work — it is not a claim about a business result, which would require the client’s consent and a baseline measured before the work began.