An assessor documents vendor-specific WPS implementation bugs as a finding class on mixed municipal hardware. What reporting principle applies?

WPS exposure varies by vendor implementation, firmware, and lockout behavior. Professional findings describe what was observed on in-scope devices and avoid universal exploitability claims based only on a WPS-enabled flag. Uniform severity without evidence, silence until firmware homogeny, or assuming offline success from wash output alone weakens report quality.