Jenkins at 3 and Kubernetes at 1: When a Small Count Means a Missing Signature

A vulnerability report that cites "only three exposed Jenkins servers" would be treated as good news. In reality it is usually a report about fingerprint coverage, and the difference matters when that number is used to justify deprioritizing a platform.

The measurements

On 20 October 2026, between 22:33 and 22:37 UTC, ZoomEye queries with sub_type="all" and a page size of one record returned:

Query Matched assets

app="Jenkins" 3

app="Grafana" 22

app="Kubernetes" 1

app="SonarQube" 12,022

app="Apache Tomcat" 585,251

app="GitLab" 1,397,539

Jenkins, Grafana and Kubernetes are all widely deployed platforms with substantial internet-facing populations. SonarQube, a far less ubiquitous tool, returns four orders of magnitude more matches.

Why the numbers invert

A product fingerprint requires a distinctive, stable, safely observable response.…