Many vulnerabilities are actually in an unexploitable state because the relevant code paths are never triggered at runtime, but vulnerability scanners cannot distinguish this, resulting in noisy alerts.