Confidence scoring

Argus attaches two independent confidence signals to what it reports, and they answer different questions. Keeping them separate is the key to triaging well.

• Detection confidence - how sure the classifier is that a given match is really sensitive data.
• Statistical confidence - how sure Argus is that the sampled result represents the full datastore.

A finding can be high on one and low on the other, and the combination tells you what to do about it.

Detection confidence

Every individual match carries a detection confidence. It is not a single fixed number per data type - Argus weighs several factors together:

• How strong the match is. A value that passes a checksum (a credit card that satisfies Luhn, an IBAN that satisfies mod-97) is far more certain than a bare pattern match.
• How it was found. A format pattern corroborated by nearby context is more reliable than a name inferred by entity recognition alone; a match confirmed by more than one method is more reliable still.
• Where it was found. Filename and path context adjust confidence up or down - a match in a file named for customers counts for more than one in a file named sample.
• Which type it is. Types that are easy to mistake for ordinary text (a name, an address, a bare number that happens to pass a checksum) are held to a higher bar than types with a distinctive shape (a private key, a cloud access key). The bar is fixed per type; it does not change with what you dismiss.

Findings roll up into high / medium / low confidence bands so you can see, per datastore, how much of what was found is solid versus uncertain, and sort your work accordingly.

Statistical confidence

Statistical confidence is a different idea entirely. Because Argus samples rather than reading every object, any full-datastore figure is an estimate, and statistical confidence describes how good that estimate is. It is expressed the way statisticians express it: a margin of error and the resulting range, derived from the Wilson score interval used for extrapolation. The draw is weighted and capped, so the range is an estimate.

Crucially, Argus tells you when a sample is too thin to trust: for an object store, the drawer says that if more than a stated share of the readable objects held sensitive data, the sample would very probably have found some (3 divided by the sample size, at 95%). A sample read in table order rather than drawn at random says it cannot bound the rest. A blind spot is never dressed up as solid.

Triaging with both

Use the two together:

Detection	Statistical	What it means
High	High	A real finding, and the estimate for the whole store is reliable. Act on these first.
High	Low	The matches are real, but the datastore is under-sampled - a deeper scan will firm up the true volume.
Low	High	Well-sampled, but the matches themselves are shaky - worth a human look before acting.
Low	Low	Weak signal all round; lowest priority.

The short version: high detection plus high statistical confidence are the findings that are both real and well-measured, and they are where remediation effort pays off first.