When a Query Returns 1,225,564 for an Appliance That Ships in Thousands

One result from a recent measurement round deserves more attention than the others, because it teaches something about every exposure number in this series.

A ZoomEye query for app="Ivanti Connect Secure" returned 1,225,564 matched assets on 20 October 2026. A separate query for app="Ivanti" returned 3.

Both cannot be correct as literal inventories of an enterprise VPN appliance. The explanation lies in how the search operator works, and it changes how any exposure figure should be reported.

What the operator does

According to the published syntax reference, the = operator performs a fuzzy match that checks whether a field contains the keyword, with the search string word-segmented for matching. The == operator performs an exact, case-sensitive match.

A three-word string like "Ivanti Connect Secure" is segmented into words. A fingerprint that contains a matching segment can satisfy the condition depending on the engine's token handling. The practical result is a broad match that is not an enumeration of a specific product.

The 3-result figure for app="Ivanti" is equally informative from the other direction: a bare vendor token does not reliably match product fingerprints that were labelled with full product names. Neither query is a count of Ivanti Connect Secure appliances.

Why this is the most useful result in the set

It demonstrates a failure mode that is easy to commit and hard to notice. An analyst runs a plausible query, gets a large number, and reports it. The number is reproducible, so it feels verified. What is not verified is whether the query means what the analyst believes.

Compare that with a case where the numbers behave plausibly. The NetScaler queries returned 239,739 for app="Citrix NetScaler", 117,407 for app="NetScaler", and 72,257 for title="NetScaler". Those are different definitions producing different answers in a range that is believable for the product. The variation is explainable; the absolute value still requires interpretation.

How to tell which is which

A short validation routine separates a trustworthy measurement from a misleading one.

Run the narrow and the broad query. If the broad vendor string returns fewer matches than the narrow product string, the two are produced by different detection rules and a simple additive or subtractive interpretation is invalid.

Check against an independent bound. If your organization operates a known number of a device, and a global query returns a figure wildly above any plausible global fleet, the query is not measuring what you think.

Vary the field. Repeating the concept across app, title, product and a header field shows whether the result is stable or an artefact of one signature.

Inspect a sample. A page size of one returns a total but no content. A bounded sample of records would show whether the matched assets resemble the product. AutoPR's exposure workflow deliberately retrieves only the count; for a measurement exercise, a small sample is worth the extra query.

Record the exact string. A count without its query text and timestamp is not reproducible, and therefore not evidence.

What this means for the articles in this series

Every count reported in this series carries its query string, sub_type, page size and timestamp for exactly this reason. Where a figure looks implausible, it is reported as implausible rather than smoothed into a narrative.

For the Ivanti discussion specifically, the defensible conclusion is narrow: the queries as written do not yield a usable population estimate for Ivanti Connect Secure. Any exposure argument must rest on the vendor's own guidance about which deployments run the affected feature, plus internal inventory.

That is unsatisfying, and it is also the correct answer. An approximate number presented without its uncertainty would have been more satisfying and less true.

The general discipline

Internet measurement answers "what can a scanner see that matches a string." Security decisions need "how many of my systems are exposed and vulnerable." Those questions are adjacent, not identical, and the gap between them is where most exposure reporting acquires false confidence.

Use external data to challenge inventory completeness, to find hosts nobody has claimed, and to establish that a product class is widely observable. Do not use it as a vulnerability census.

References