Operating Theory · 2026-09-15
Unknown is red
If nobody can show that a control works, score it as failing. Amber and blank let an untested control sit quietly beside a tested one.
Under the pillar The dangers of security theatre
The observation
Security reporting almost always has a not assessed category, and it is almost always the largest one. Because it is neither green nor red, it receives no attention and no budget, and it accumulates.
Treating unknown as red changes the conversation immediately. The first reaction is usually that the board will panic. The second, after a quarter, is that the organisation now knows which controls it has actually verified.
The cost
This rule has a real cost. Verification is expensive, and some controls are hard to test in production. An untested control may still help, but the organisation cannot claim that it works.
Put this to work
Unknown is red challenge record
Test the claim behind Unknown is red against a real case and look for where it fails.
- For
- Practitioners, researchers, founders, and operating leaders.
- What you keep
- A unknown is red challenge record you can review, revise, and send.
- What counts as sound
- Makes the claim testable
- Includes contrary evidence
- Preserves competing explanations
- States uncertainty
- Names what would change the conclusion
The result is a working analysis. Check it against source evidence and qualified judgment.
Nothing entered here is stored or sent. Review the prompt before sharing confidential, personal, patient, or privileged information.
Review the prompt
You can leave any field blank. The prompt will mark it as not provided.
If the record survives your review, send the question, evidence, unknowns, and requested next step.