Public validation evidence

Show the work.

We build fictional companies, document what is really configured, then test our scanners against an independent answer key. This is the dated record of what worked, what failed and what a later test verified.

Loadingrecorded runs

Loadinglatest outcome

Loadingengine version

WeeklyMonday, 08:00 Singapore

Measured scenarios, clear limits. Precision is the share of reported findings that match the answer key. Recall is the share of expected findings the scanner found. Neither is a promise of complete enterprise coverage. TLS positive assertions are scored separately; unknown negatives and missing groups remain failures.

An expanding test company

Eight company profiles are now built, from a Python analytics extension through a Java Spring portal, a PHP and Perl site, a .NET finance service on SQL Server, the container and VM platform, the data tier with three clouds, and a whole-company run. They are a regression suite: each was tuned, so their pass rate is a floor, not an accuracy estimate. The independent weekly evaluation above is the accuracy measure.

Next steps

An agent-planning harness that grades tool selection against the same answer key; a weekly variation axis (certificate rotation, permission loss, dependency change) so the same profile tests differently; and monthly replenishment of the independent pool. These are planned, not claimed coverage. No finite lab can cover every possible enterprise configuration.

Independent weekly evaluation

Separate from the run history below. Each week a fresh set of weaknesses is drawn from a pool written before the engine saw it, and is not tuned against. The number is the share of planted weaknesses the scanner reported. A miss here is a measurement, not a test that was adjusted until it passed. Cases that are fixed move into the regression suite and are replaced in the pool.

Loading independent evaluation…

Run history

Failures remain in the record. A later fix is marked verified only when the corresponding checks pass in a later run. Raw reports expire under the artifact retention limit; the public summaries remain here.

Loading measured run history…