Definitions
Terms used in this paper
These definitions establish how the paper uses its core terms before the argument begins.
- Operating record
- The durable customer-specific source record of findings, actions, verification, evidence quality, and exceptions.
- Executive summary
- A concise governance view generated from the operating record rather than replacing it.
- Exception owner
- The customer or provider role accountable for a governed unresolved condition.
- Evidence coverage
- The extent to which required customer systems and sources are currently observable.
1. The monthly deck is a summary, not the evidence itself
Managed security reports often summarize alert volume, incidents, patching, vulnerabilities, and recommendations. The format is useful for account reviews, but the static deck becomes fragile when it is the only durable record of what happened.
A better architecture keeps underlying findings, actions, verification, evidence quality, and exceptions in a customer-specific evidence history. The report is generated from that history rather than becoming a separate narrative that can drift from it.
2. Executives need decisions, not raw telemetry
Customer leaders usually need to know what materially changed, which risks remain unresolved, where the MSSP needs customer authority or investment, and whether prior interventions held. Raw event volume belongs in supporting detail, not at the center of governance.
This keeps reporting concise without becoming vague. Each executive statement can point back to the evidence or exception that supports it.
State what changed, what remains unresolved, and which decisions are needed.
Supported by
Outcome evidenceTrace improvement claims to actions and follow-up observations.
Supported by
Owned exceptionsKeep rationale, owner, and review dates attached to unresolved conditions.
Qualified by
Observation qualityExpose stale sources, missing coverage, and uncertainty.
A summary is a view of customer-specific evidence. The customer controls sharing with audit, insurance, and other reviewers.
3. Exceptions should have owners and clocks
Managed providers routinely encounter findings that cannot be fixed immediately. Governance improves when those exceptions are explicit, time-bounded where appropriate, and assigned to a customer or provider owner.
A report can then show which risks are being remediated, which are accepted, which are blocked by dependency, and which have exceeded their review date. This is more actionable than an undifferentiated open-findings count.
4. Evidence quality belongs in customer governance
If a major integration has been offline for three weeks, a favorable security summary should say so. Observation quality is part of the service condition because missing telemetry limits what the MSSP can credibly claim.
Reporting evidence freshness and coverage helps the customer restore missing visibility and prevents false confidence when monitoring coverage is degraded.
5. Better reporting supports audit, insurance, and board use
A customer-specific evidence record can support multiple governance audiences without giving each audience the same access. Executives may see summaries, auditors may inspect selected control evidence, and brokers or carriers may receive an authorized package for renewal.
The MSSP remains responsible for its service role, while the customer controls how its evidence is shared. That model makes managed-security reporting more durable and more useful than a presentation assembled from scratch each month.
Evidence base
Sources and notes
External foundations are kept distinct from VitalSec implementation notes so readers can see what supports the argument independently and what documents the platform implementation.
External foundations and sources
VitalSec implementation notes
These links document how the argument is implemented or described inside VitalSec. They are not offered as independent validation of the paper's thesis.