Definition
Continuous security verification is the repeated qualification of security evidence across the delivery lifecycle. Instead of evaluating evidence once at a single gate, it re-evaluates as the artifact, policy, or threat context changes.
This prevents stale approvals and old scanner states from carrying authority into a new release context.
Why it matters
It prevents stale approvals and old scanner states from carrying authority into a new release context. A decision made on last week's evidence may not be valid for today's artifact.
Example
A release candidate is rebuilt after a dependency update. Continuous verification re-evaluates the evidence bundle against the current policy version, rather than inheriting the previous build's approval.
Related terms
- Security verification body — An independent function that evaluates whether security evidence satisfies policy for a consequential decision.
- Release-evidence verification — The practice of determining whether the evidence behind a software release decision satisfies versioned policy.
- Evidence ladder — A governed sequence of evidence states that prevents raw signals from being treated as proof.