This seems like a trivial thing to verify though, point it at a known software version with a CVE, like OpenSSL / Heartbleed, or some of the more recent SSL / PHP / Node / HTTP issues. Then you would expect it to find the Heartbleed vulnerability quite quickly. If it does not, investigate and iterate.