VitalSec platform
VitalSec Evidence Continuity
Evidence · source · attestation
Evidence Continuity keeps the source, time, decision, action, follow-up observation, and integrity information together as the work happens. An audit, renewal, or claim can use that existing evidence instead of reconstructing the history later.
Why Evidence Continuity matters
Reconstructing a security event means piecing together records from security tools, tickets, screenshots, and people’s recollections.
Reconstructed later
Source and timestamp context can be lost when evidence is copied between systems.
A ticket may stay closed even after the control fails again.
Before-and-after evidence often has to be inferred rather than directly linked.
Preserved as the work happens
Evidence chain
Evidence Continuity keeps the relationships that make evidence useful: where it came from, what was observed, why an action was approved, what happened, what the environment showed afterward, and how the record can be checked for integrity.
01
Who or what produced the observation, and which environment it came from.
02
What was observed, when it was observed, and whether that evidence is current, stale, missing, or conflicting.
03
Why an action was approved or a conclusion was supported by the evidence available at that time.
04
What was attempted or changed, who authorized it, and what the system recorded about the action.
05
What the environment showed afterward and whether the intended condition actually held.
06
How the evidence package can be checked for integrity and traced back through its source history.
Evidence continuity
Evidence Continuity keeps evidence tied to freshness. If an observation becomes stale, disappears, or conflicts with another source, that condition stays visible instead of being presented as a timeless answer.
CURRENT
The evidence is inside the expected freshness window and supports the current view.
STALE
The evidence was once valid but has aged beyond the expected observation window.
MISSING
The expected evidence is absent; VitalSec does not silently infer a healthy state.
CONFLICT
Sources disagree or incompatible observations exist; the conflict remains visible until it is resolved.
Proof batch
One evidence package
Merkle root
tamper-evident batch commitment
Classical signature
Ed25519
Post-quantum signature
FIPS 204 · ML-DSA-65
One verifiable evidence record
Ed25519 and ML-DSA-65 attest the same Merkle-rooted proof batch.
Post-quantum cryptography
Evidence Continuity signs the same proof batch with classical Ed25519 and FIPS 204 ML-DSA-65. The paired design keeps current verification compatibility while adding a NIST-standardized post-quantum signature to the same evidence package, and both signatures travel with the record through verification and export.
One proof record. Classical + post-quantum signatures.
The Merkle root commits the evidence. Ed25519 and ML-DSA-65 attest that same proof batch so the record can be verified across both signature paths.
Stable construction rules make the same evidence inputs produce the same representation instead of an opaque one-off artifact.
Evidence is committed into a tamper-evident structure so later exports can be checked against the preserved root.
Each proof batch carries an Ed25519 signature and a FIPS 204 ML-DSA-65 signature over the same evidence package.
Verification and export paths check the cryptographic material carried with the evidence instead of relying on a visual badge.
Where the evidence goes
Evidence Continuity lets authorized teams use the same source-linked evidence history for security, audit, leadership, insurance, or claims work without giving those teams control of the underlying environment.
Show what was true before remediation, what action ran, and what the environment showed afterward.
Present source, time, evidence continuity, and cryptographic integrity without rebuilding the history from screenshots and ticket comments.
Carry current control, remediation, incident, and validation evidence into renewal, underwriting, and claims workflows.
Support higher-level decisions with evidence that can be traced back to the underlying environment instead of a detached summary.
Evidence scope
Evidence Continuity keeps the signed facts, their source, their freshness, and their scope together so an integrity check strengthens the record without obscuring what was actually observed.
VUMA and CAAT are two capabilities that can feed important before-and-after evidence into Evidence Continuity.
