Where it is not possible to confirm a potential vulnerability without risking disruption to your services, — such as Denial of Service attacks, or buffer overflows —vulnerabilities may be flagged on the basis of a software version number rather than generating the actual error condition.
This can lead to false positives, whereby a vulnerability that has already been fixed is reported on the basis of the software version.
We continually improve our tools to try and eliminate as many false positive issues as possible, and additionally make it possible for our customers who have a publicly-displayed Audited By Netcraft seal to mark vulnerabilities as patched. The person marking a vulnerability as a false positive effectively signs for this, making accountability possible within large organisations.