01
Is the evidence current?
Check the observation time and the freshness requirement for the control.
VitalSec field guide
Read and act on VitalSec findings.
Use this guide to interpret control states, validation results, evidence freshness, exposure windows, and risk direction. Each reading shows the requirement, the observed condition, and the evidence behind its status.
Compare the requirement with the observation, check its age, and review the validation record before closing a finding.
- A reading is
- Observed control state
- Judged against
- A stated requirement
- Weakened by
- Age of evidence
- Closed by
- Verified retest
Reading details
ControlDisk encryption — laptop fleet
Required stateEnabled and enforced by policy on every managed laptop
Observed stateEnabled on 118 of 124 laptops; 6 report policy not applied
ReadingDEGRADED
Last observed38 minutes ago · counts as current
Each reading identifies the control, its required state, the observed condition, and the observation time.
- What is being checked
The specific security control being assessed.
- Required state
What should be true here.
- Observed state
What was actually seen.
- Reading
The status supported by the observation.
- Freshness
When the observation was taken.
02
What is true now?
Compare the observed condition with the requirement and review any gaps.
03
Which direction is risk moving?
Look at exposure time, retest results, repeat failures, and whether the result held.
01 — REQUIRED VS OBSERVED
Compare required and observed state
The status shows whether the observed control meets its requirement. Review both values to understand what needs attention.
Check the source and observation time.
Confirm that the source is authoritative for the condition being assessed and that its evidence meets the freshness requirement.
controlrequired stateobserved statereading
- Multi-factor authenticationrequiredEnforced for all administrators, no exemptionsobservedEnforced for 41 of 44 admins; 3 legacy accounts exemptDEGRADED
- Backup restore testrequiredA successful restore proven at least every 30 daysobservedLast successful restore 74 days agoFAIL
- EDR coveragerequiredAgent installed, running, and tamper protection onobservedNo check-in from 9 devices for 11 daysMISSING
The reading is the comparison of required and observed state. Change the requirement and the same observation can read differently — which is why the requirement stays visible next to it.
Required and observed state
VitalSec shows which requirements the observed control fails to meet. Use that difference to define the remediation work.
02 — CONDITION VS CHECK
Control state and validation history
Current operating condition can drift or decay over time. A test result records one check at one moment. VitalSec works in a loop: Observe → Decide → Act → Validate → Prove → Measure. This guide explains how to read the state and evidence that loop produces.
Current operating condition
Control state
Is this control in the state it is supposed to be in right now?
GOODDEGRADEDFAILMISSING
- It can change without anyone running a test.
- It weakens as the supporting evidence gets old.
- It reads MISSING when VitalSec cannot substantiate the condition from current evidence.
Tamper protection is off on 4 servers. Control state: DEGRADED.
Dated validation result
Test result
What did the check establish at the time it ran?
PASSFAILINCONCLUSIVE
- It has a start, a finish, and a timestamp.
- A retest records whether the required condition was observed after remediation.
- It reads INCONCLUSIVE when the check did not produce enough trustworthy evidence for a verdict.
Retest after patching returned the required build. Test result: PASS.
A passing retest confirms the required condition at the time of the check. Subsequent observations establish whether that condition continues to hold.
03 — STATUS DEFINITIONS
Status definitions and actions
Control states are GOOD, DEGRADED, FAIL, or MISSING. Validation results are PASS, FAIL, or INCONCLUSIVE. FAIL applies to both: a control can fail its requirement, and a check can return a failed result.
Control states and validation results
readingwhat it meansexamplewhat to do
- GOOD
control state
Observed, recent, and matching the required state.
Disk encryption on and policy confirmed 42 minutes ago.
Keep watching for drift.
- DEGRADED
control state
The control exists, but some part of the required condition is weaker than it should be.
EDR running, tamper protection disabled on part of the fleet.
Fix the weak part; do not treat it as fully covered.
- FAIL
control state / test result
The observed control or completed check fails the requirement.
Backup job failed on the last three scheduled runs.
Remediate the failure and retest to verify closure.
- MISSING
control state
VitalSec does not have usable current evidence for the condition.
Agent has not reported for 9 days; the last reading is stale.
Restore evidence collection and reassess the control.
- PASS
test result
One specific check ran and the result met the requirement.
Retest after patching shows the required build is installed.
Record it, then confirm the control state keeps holding.
- INCONCLUSIVE
test result
The check ran, but the evidence is not strong enough for a reliable verdict.
Scan interrupted; partial data returned.
Resolve the interrupted or incomplete check, then run it again.
MISSING identifies absent or stale control evidence. INCONCLUSIVE identifies a check that needs additional evidence or another run.
04 — FRESHNESS AND STALENESS
Check evidence freshness
Every reading includes an observation time. The control’s freshness requirement determines when new evidence is needed.
HOW CONFIDENCE DECAYS
Each control has a freshness requirement. When its evidence expires, the control requires a new observation before its state can be confirmed.
Current
0–24 hours
Recent enough to count as the current reading for this example.
Aging
1–7 days
Still visible, but weaker as an answer to whether the condition is true right now.
Stale
over 7 days
No longer treated as current. The reading falls back to MISSING until fresh evidence arrives.
- When a reading changes without anyone touching the environment, check the observation time first. Freshness may be the reason.
05 — EXPOSURE WINDOW AND CLOSURE
Track exposure through verified closure
The exposure window opens when a meaningful gap becomes observable. Work can be assigned and completed, but the window stays open until a fresh check confirms the required condition has been restored.
Exposure window
worked example · 11 days open
- OBSERVED
The first observation establishes the start of the exposure window.
- WORKED
Approved remediation is performed. The exposure window remains open pending validation.
- RETEST PASS
A check returns the required state. This is the point where the window can close.
- HELD
Later observations continue to support the required state.
The horizontal span shows how long the exposure remained open. Track that duration from the first observation through verified closure.
06 — RISK DIRECTION
Review risk direction over time
A single reading tells you what the evidence supports now. Direction tells you whether exposure is being compressed, holding, expanding, or simply becoming harder to see.
Improving
Gaps are closing faster than new ones appear, and verified fixes are holding.
what to check — Confirm the improvement comes from closure, not evidence dropping out of view.
Flat
New and resolved exposures are roughly balanced. Review the exposures that remain open.
what to check — Check whether the same controls keep coming back.
Deteriorating
New gaps are outpacing closure, or exposure windows are getting longer.
what to check — Look at time to closure and repeat failures before adding more detection.
Losing visibility
More readings are becoming MISSING as evidence expires or collection fails.
what to check — Treat visibility loss as a problem of its own.
Risk Floor (R_min)
The strictly positive lower bound of residual risk in the Ford Model for the system and assumptions being considered. R(t) is the modeled residual-risk state at time t, not the floor: R(t) ≥ R_min > 0.
Under the model's attracting-bound assumption, sustained compression drives risk toward R_min, the irreducible lower bound. Numerical estimates require evidence and validation for the system being modeled.
Read the Risk Floor paper07 — DEFINITIONS
The vocabulary used across VitalSec
Definitions for control state, evidence quality, remediation, and modeled risk direction.
Definitions
Use these definitions when reviewing control findings, remediation records, and risk measurements.
- Control state
- The current condition of a control, established from available observations.
- Required state
- The condition policy, customer standard, or another authorized requirement says should be true.
- Drift
- The observed condition moved away from the required state after previously matching it.
- Decay
- Internal deterioration, including configuration drift, weakened controls, and aging evidence.
- Proof continuity
- Evidence that enforcement remains present and effective over time.
- Exposure window
- The time between a meaningful gap becoming observable and fresh evidence showing it is closed.
- Closure
- A gap closes when a retest confirms the required condition and the result is recorded.
- Risk compression
- Modeled risk moving downward as Enforcement and Proof Continuity outweigh Decay and Adversarial Pressure.
01
02
03
04
05
06
07
08
08 — ONE READING, DIFFERENT DECISIONS
Evidence across authorized workspaces
Customers, brokers, carriers, reinsurers, managed-service operators, and portfolio teams can use the same underlying evidence differently. Permissions decide how much detail each workspace can see and what it is allowed to do with it.
Evidence by workspace
source reading
Multi-factor authentication — admins
DEGRADED
observed 51 min ago · window open 6 days
Each workspace uses the underlying evidence within its access permissions. Those permissions determine the available detail and permitted actions.
Customer
3 admin accounts are exempt from MFA. Owner: IT. Due in 4 days.
Named systems, named owners, and the work required to clear the reading.
Broker
MFA control: DEGRADED. Remediation in progress. First observed 6 days ago.
Whether the account can be presented accurately today and what still needs attention before renewal.
Carrier
MFA does not currently meet the underwritten requirement. No retest recorded.
The reading against the relevant requirement and dated evidence when it changes.
Reinsurer
MFA gaps present across part of the authorized book; median exposure window 9 days.
Concentration, evidence quality, and movement across the book without unnecessary account-level detail.
MSP / MSSP
Work queued for this customer. Second occurrence of the same gap in 90 days.
What is outstanding, what was approved, what was retested, and what keeps recurring.
Portfolio Operations
MFA readings: 62% GOOD, 21% DEGRADED, 17% MISSING evidence.
Where exposure or missing proof is concentrating across portfolio companies and whether closure time is improving.
NEXT
Explore platform capabilities and architecture.
Review the controls VitalSec validates, the actions it supports, and the components that collect and preserve evidence.