Finding weight and evidentiary value¶

Two findings describing identical security openings can carry entirely different operational values. The true weight of a finding depends on where it exists within an environment and whether it rests on verified evidence or logical inference.

Evidence, inference, and decay¶

A capability established through direct observation differs fundamentally from one inferred from general patterns. Requesting a ticket, cracking it offline, and validating access against a target host constitutes empirical evidence. Conversely, assuming a service account has a weak password simply because its name begins with a predictable prefix is merely an inference based on naming conventions. Both findings belong on a network map, but the second carries a lower weight because any plan resting on it relies on an unverified assumption.

Evidentiary provenance sits alongside each finding: whether it was directly observed, actively tested, logically inferred, or assumed from environmental design. Weight decays differently across each category. Direct observations age as environments change, inferences break the moment their underlying assumptions stop holding, and credential-based access decays according to password rotation policies or token expiration windows.

Positional value and contextual impact¶

The value of a finding is dictated by its position within an environment rather than its standalone severity. An insecure session token on an isolated host is an operational curiosity, whereas the same token on a dual-homed system bridging two networks represents critical access. Similarly, an over-permissioned role in a test environment may carry minimal risk, but that exact same role inside a build account creating production images alters the security posture of the entire organisation.

Finding values hold in context rather than in isolation. Findings are priced against the overall network graph as it is being drawn, making early weightings provisional by design. Re-evaluating a week-old finding after mapping identity relationships and network access is often the simplest way to discover a move that was already available.

Negative findings and path elimination¶

Technical findings do not always expose new access pathways, as many observations explicitly eliminate potential options. Discovering that directory traffic enforces signing removes authentication relay pathways, a firewall blocking a specific segment eliminates a planned network route, and a rotated key invalidates a previously viable credential.

Organisations frequently fail to record negative findings. This oversight often leads to planning moves that rely on access paths already ruled out by prior observation simply because no one documented their closure.

Carrying provenance and weight forward¶

Operational intelligence moves forward as a map of available access pathways, where each route carries an assigned weight and clear provenance. Treating finding weight as an integral attribute of an access path rather than a secondary comment prevents planning around a level of certainty that does not exist in reality.