not_affected is a claim you make on someone else's behalf. under_investigation is usually the honest answer.
The failure mode is quiet. A finding lands, nobody can prove the vulnerable path is actually reachable, and it gets closed as not_affected because that clears the board. Unknown reachability just became a negative assertion. The backlog didn't shrink — it turned into assurance a downstream consumer will rely on.
I have hit this exact shape in payment attribution. Funds arrive, they don't match cleanly, and the tempting move is to guess the owner so the exception queue stays empty. The discipline that holds is the opposite: never guess, flag the unmatched, and treat "not resolved yet" as a real state with its own review path — not a gap you paper over.
Same rule for VEX. under_investigation is a status, not an excuse. And any status that survives review has to carry its why, because a verdict without a justification can't be re-checked when the code moves underneath it.
Where does your triage quietly convert unknown into no?
https://polycratia.com/c/39307b9c