Signed record · Standard v1

The Proof Standard

A run's signed record counts only if the run meets every rule below. The Standard is public and versioned, and every verifier states the version a record meets, so "Do you have a signed record that meets it?" has a yes-or-no answer anyone can check.

v1. A later version gets a new number; this text does not change.

The nine rules

  1. Scope. All the accounts the install watches. A narrower run is labelled "partial scope" and shows the share it covered.
  2. Footholds. At least one of each standard class present in the accounts (workload, human session, pipeline, leaked key), each chosen by Warden's reach ranking as the widest-reaching of its class. A foothold the company removes or replaces is labelled, with its reason.
  3. Catalogue. The current release's attack catalogue or the one before it, with both tracks run: the scripted chains, and the swarm given only a goal.
  4. Defend on. Containment signed by the company's own approvers. A run with Watch alone can never be published as a signed record.
  5. Integrity. The run completed. Its start was recorded in the log before the first attack call. No external-access finding, no safety breach, and it stayed under its cost ceiling. Teardown verified clean, by tag and by the run's own record of what it created. CloudTrail log-file validation on for the window, and an AWS anchor present.
  6. Honest labels. Every human-latency figure (seen to signed, signature to stop, attack start to stopped) is present and printed with "approvers knew a run was on". Times are measured, and expected misses and what was not tested are listed.
  7. Analysis in the headline. The public view always shows how many real data stores analysis found reachable. The outcome word is plain "Held" only when the tested goals held and that count is zero.
  8. Assurance and warmth. The run is self-run or witnessed, on an install that has watched the accounts for at least 7 days. A sample (synthetic accounts or a day-0 install) is a reference run, never a record that meets this Standard, and fails this clause with the reason "reference run".
  9. Validity. The statement carries its own issue and expiry dates. The Standard's default is 90 days; past it, the badge reads Stale.

The words

A signed record attests one run: in this scope, from these footholds, on these dates, an agent swarm tried to reach these goals, and this is what it reached, what was seen, and what one signature stopped. The same sentence, filled from the record, is printed on every Proof page and letter.

  • Held: every tested goal was left unreached in this run and scope, and analysis found no path from any foothold to a real data store.
  • Held in test · n reachable by analysis: the tested goals held, and analysis found n paths to real data stores. Never shortened to "Held".
  • Reference run: a sample in synthetic accounts or on a day-0 install. It carries no outcome word.

Neither outcome word means a company cannot be breached. The Standard refuses the words "certified", "certificate", "certification", "compliant", "guaranteed", "bulletproof" and "unhackable" on any Proof, page or letter. Only a witnessed Proof may be called independent, and then only under the witness's own name. Warden vouches only for its own release, never for a company's result.

What a badge can say

A badge is a link to the verify page, never evidence on its own; a static copy of one proves nothing.

Current
Inside its dates, with the accounts as tested.
Changed since Proof
Scope grew, or a credited control or Watch's configuration changed.
Stale
Past its expiry date.
Withdrawn
Its approvers took it back with a signed withdrawal, recorded in the log.

What a Proof never claims

  • Anything beyond one run, in one scope, on stated dates.
  • Independence, unless a tester of the company's choice witnessed the run.
  • Reach to real data: real data is never read, and real resources are never changed, so that reach is computed and printed as analysis.
  • Social engineering of real people, escapes on real nodes, attacks on the management account or Identity Center, or evasion of the company's real logging: these are listed as not tested in customer runs, with the reason.
  • Resistance to a company that stages a run in cloned accounts. The domain binding, the licence and the account ids inside AWS's signed records make that costly and visible in diligence; a witnessed run closes it.

Versions

The Standard is versioned. Raising the bar in a later version is a natural moment to renew; a Proof keeps the version it met. A newer catalogue shows "newer catalogue available" without voiding a current Proof.

Back to the signed record.