Every finding generated by the scanning engine goes through an adversarial verification pass before it reaches any report. This is not a simple deduplication or severity reranking. It is a structured challenge process inspired by the Contrarian Gate: "Is this what everyone does? If so, why would it give us an edge?"

The adversarial pass asks three questions of every finding. First: is this a real vulnerability, or is the scanner pattern matching on surface similarity without understanding the mitigating context? Many false positives arise because scanners detect a pattern that looks like a vulnerability without understanding that the surrounding architecture neutralizes it. Second: if this is a real vulnerability, is the proposed severity accurate?

A SQL injection in a read only analytics endpoint behind authentication is real but not critical. Third: is the proposed remediation actually safe? Will fixing this issue introduce a regression, break a dependent component or create a new attack surface?

The result is a dramatic reduction in false positives. Traditional scanners optimize for recall and finding everything, even at the cost of noise. Otonomii optimizes for precision so every finding that reaches the report is actionable, contextualized and verified. The adversarial pass applies the "Too Good To Be True" check: if a scan produces zero findings, that itself is suspicious and triggers a meta review of the scanning process.