Skip to content
GoSentrix

Research

Security claim to evidence gap

A security claim is an assertion that risk is absent or under control. The research question is simple: how often do such claims arrive without evidence that can be independently replayed?

Methodology

We constructed a synthetic, internal-demo corpus of security claims drawn from four common sources: static scanner findings, software composition findings, ticket closure events, and control-pass records. Each claim was evaluated against a single criterion: does an independent artifact corroborate the claim? Corroboration could be a retest result, a reviewer attestation with artifact references, runtime telemetry, or a second tool result pointing to the same artifact.

  • Claims were sampled across a simulated six-month delivery window.
  • Only claims tied to a specific commit, build, or ticket were included.
  • A claim was marked "with evidence" only if the corroborating artifact was reachable and version-matched.

Findings

In an internal demo corpus of 1,247 security claims, roughly one in three lacked corroborating evidence. The gap varied by source. These numbers are synthetic and illustrative, not customer outcomes.

Claim sourceClaims reviewedWith corroborating evidenceWithout corroborating evidence
Scanner findings (SAST/SCA)612478 (78%)134 (22%)
Ticket closure events348205 (59%)143 (41%)
Control-pass records215157 (73%)58 (27%)
Attestation-only claims7227 (38%)45 (62%)
Total1,247867 (70%)380 (30%)

Synthetic, internal-demo figures. Not representative of customer environments or industry averages.

Limitations

  • The corpus is synthetic and constructed for demonstration purposes. It does not reflect any customer data.
  • Definitions of corroboration differ across organizations. Our criterion may be stricter or looser than yours.
  • We did not measure exploitability or actual incident outcomes, only the presence or absence of supporting evidence.
  • The sample is limited to four common claim sources.

What this does not prove

  • It does not prove that missing evidence equals a real vulnerability.
  • It does not prove that scanners, tickets, or controls are unreliable.
  • It does not prove an industry-wide rate; it is an internal benchmark used to test our own reasoning.
  • It does not prove that collecting more evidence automatically reduces risk. Evidence must still be evaluated against policy.

Frequently asked questions

What counts as a security claim?

A security claim is any assertion that a risk is absent, reduced, or under control. Examples include scanner findings marked resolved, tickets closed as fixed, control gates passed, and attestations that a change was reviewed.

Why do claims lack corroborating evidence?

Claims can outrun evidence when workflow state changes faster than verification. A ticket may close after a code change even though no retest or independent review has confirmed the fix.

Related reading

Doctrine

The public operating doctrine for release-evidence verification.

Platform

How GoSentrix qualifies evidence and evaluates it against policy.

How to prove a vulnerability was fixed

Move from ticket closure to verified remediation evidence.

Validated autonomous remediation

Independent verification for automated remediation claims.

Close the evidence gap.

GoSentrix qualifies security claims, evaluates them against versioned policy, and escalates claims that lack sufficient proof.

Explore release-evidence verificationRead the doctrine