Two breach-lookup tools disagree on whether a procurement email appears in a public exposure corpus. What belongs in the report?
Select an answer to reveal the explanation.
Short Explanation
When two meters disagree, you do not average them into a fake yes. You show both readings and where they came from. The conflict is part of the finding.
Full Explanation
OSINT tools can disagree because corpora, refresh rates, and coverage differ. When two breach-lookup tools disagree on whether a procurement email appears in a public exposure corpus, the report should include both results with tool names, timestamps, and sources so the conflict is visible. Civic readers need that transparency to judge confidence rather than consuming a false single answer.
Averaging into a yes-or-no with tool names omitted hides methodology and invents certainty. Showing only the result that matches the director's preferred narrative is cherry-picking. Cracking a mailbox to decide which tool was right is unauthorized access and leaves PORP entirely.
Exam caveat: 'appeared in a public exposure corpus' is not the same as 'mailbox is currently compromised'; keep wording tied to what each tool reported at retrieval time.
Operational check: record Tool A and Tool B outputs with dates, quote the email queried, present both in the report, and escalate only with sourced conflict—never with mailbox attacks. In municipal practice, keep the wording tied to public artifacts, retrieval dates, and the authorized civic question so peers can re-perform the work without guessing intent.