Confidence scoring

Argus attaches two independent confidence signals to what it reports, and they answer different questions. Keeping them separate is the key to triaging well.

• Detection confidence - how sure the classifier is that a given match is really sensitive data.
• Statistical confidence - how sure Argus is that the sampled result represents the full datastore.

A finding can be high on one and low on the other, and the combination tells you what to do about it.

Detection confidence

Every individual match carries a detection confidence. It is not a single fixed number per data type - Argus weighs several factors together:

• How strong the match is. A value that passes a checksum (a credit card that satisfies Luhn, an IBAN that satisfies mod-97) is far more certain than a bare pattern match.
• How it was found. A format pattern corroborated by nearby context is more reliable than a name inferred by entity recognition alone; a match confirmed by more than one method is more reliable still.
• Where it was found. Filename and path context adjust confidence up or down - a match in a file named for customers counts for more than one in a file named sample.
• False-positive history. Data types that have historically produced more false alarms are held to a higher bar, and that bar adapts as detection learns.

Findings roll up into high / medium / low confidence bands so you can see, per datastore, how much of what was found is solid versus uncertain, and sort your work accordingly.

Statistical confidence

Statistical confidence is a different idea entirely. Because Argus samples rather than reading every object, any full-datastore figure is an estimate, and statistical confidence describes how good that estimate is. It is expressed the way statisticians express it: a confidence level (95% by default) together with a margin of error and the resulting range, derived from the Wilson score interval used for extrapolation.

Crucially, Argus tells you when a sample is too thin to trust. If the sampled fraction is very small, or the sample is too small to meet the statistical assumptions behind the estimate, the estimate is flagged rather than presented as if it were solid. A blind spot is never dressed up as a confident number.

Triaging with both

Use the two together:

Detection	Statistical	What it means
High	High	A real finding, and the estimate for the whole store is reliable. Act on these first.
High	Low	The matches are real, but the datastore is under-sampled - a deeper scan will firm up the true volume.
Low	High	Well-sampled, but the matches themselves are shaky - worth a human look before acting.
Low	Low	Weak signal all round; lowest priority.

The short version: high detection plus high statistical confidence are the findings that are both real and well-measured, and they are where remediation effort pays off first.