Evidence
A register of the security theatre research program: what it tests, the evidence it uses, and the patterns it has found.
- Standard
NIST Cybersecurity Framework 2.0
Organises outcomes across govern, identify, protect, detect, respond, and recover. Used here as a requirement source, not as evidence of effect.
Used by Attack-and-recovery engineering, Compliant Insecurity
- Standard
NIST SP 800-61, computer security incident handling guide
The reference model behind the detection, containment, and recovery intervals this area measures.
Used by Attack-and-recovery engineering
- Standard
NIST SP 800-34, contingency planning guide
Establishes recovery objectives as planning targets. This area asks for the demonstrated result beside the target.
- Standard
NIST SP 800-53 revision 5, security and privacy controls
A large control catalogue, useful for mapping requirements to testable statements.
Used by Compliant Insecurity, GRC engineering
- Standard
NIST SP 800-161 revision 1, supply chain risk management
Third-party practice guidance. The gap this area studies is between its practices and the tested escalation path.
- Standard
NIST SP 800-63, digital identity guidelines
Authenticator assurance levels, including the properties that make a credential resistant to phishing.
Used by Human error without human blame
- Advisory
CISA Known Exploited Vulnerabilities catalogue
A public record of what is actually being exploited, useful for separating theoretical from observed risk.
Used by The dangers of security theatre
- Advisory
CISA guidance on phishing-resistant multifactor authentication
Shows how the credential itself can block phishing even when a message fools the user.
Used by Human error without human blame
- Advisory
CISA Stop Ransomware guidance
Practical recovery material, including isolated backup guidance used in the restore experiments.
- Advisory
CISA Secure by Design
Places responsibility for safe defaults with the supplier, which is the vendor-side form of this area's design argument.
Used by Vendor and supply-chain resilience, Human error without human blame
- Reference
MITRE ATT&CK
The behaviour catalogue used to select techniques for detection and containment measurement.
Used by The dangers of security theatre, Attack-and-recovery engineering
- Reference
MITRE ATLAS, adversarial threat landscape for AI systems
Relevant as AI components enter both the defensive stack and the attack surface.
Used by AI-native defensive security
- Standard
NIST AI Risk Management Framework
Used when assessing AI components in defensive workflows, where the same evidence standard applies.
Used by AI-native defensive security
- Regulatory guidance
HHS, HIPAA Security Rule
A frequent source of the compliant insecurity pattern, because many requirements ask whether a process exists.
Used by Compliant Insecurity
- Regulatory guidance
HHS, HIPAA Privacy Rule
The documentary baseline against which observed data handling is compared in healthcare settings.
- Regulatory guidance
European Data Protection Board guidelines
Interpretation of purpose limitation, minimisation, and erasure, which the privacy experiments test against systems.
- Standard
NIST Privacy Framework
A structure for privacy outcomes that can be mapped to engineered tests.
Used by The dangers of data privacy theatre, GRC engineering
- Public report
Verizon Data Breach Investigations Report
Annual incident pattern data. Useful for base rates, with the usual caution that the sample is not a population.
Used by The dangers of security theatre, Vendor and supply-chain resilience
- Reference
Compliant Insecurity
Collected material on organisations that satisfy their frameworks while remaining unable to detect, contain, or recover.
Used by Compliant Insecurity, GRC engineering
- Reference
Operational Truth
The intended, reported, recorded, inferred, observed, and verified distinction used throughout this area.
Used by GRC engineering, Attack-and-recovery engineering, Compliant Insecurity
Back to Zero Security Theatre · Experiments · Evidence · Patterns