False negatives

A clean scan means the tool found nothing it knows how to look for, in the places it was pointed at.

That is a much weaker statement than "there is nothing wrong", and it routinely gets reported as the latter. Coverage is the hidden variable: systems the scanner never reached, credentials it did not have, flaw types it does not check. A clean result with unknown coverage is not evidence of safety, and the number worth asking for is not how many findings there were but what proportion of the estate was actually looked at.