Detection verification is an evidence-based determination of whether a deployed detection meets its required operating conditions within an explicitly stated scope, environment and point in time.
Enabled is not armed. An enabled status records a setting. A verification claim requires evidence about the detection in the environment where it is deployed.
Every verification claim must have a defined scope, inspectable evidence and an explicit account of what remains unestablished.
What counts as verification
- Explicit scope. The assessment identifies the claim being tested and the conditions it covers. Its scope is set before evaluation, and its conclusions remain within that boundary.
- Evidence sufficient for the claim. Another reviewer can inspect the evidence, understand the reasoning and challenge the conclusion. Confidence or an enabled status alone is insufficient.
- Visible uncertainty. Missing evidence and unsupported conditions remain unresolved. They receive no credit as verified and stay visible in the reported scope.
- A bounded result. The conclusion applies to the assessed environment and time. A material change requires fresh evidence.
Verdict vocabulary
A structural assessment uses three verdicts. Each is meaningful only alongside its stated scope and limitations.
- Can fire
- The required conditions within the stated structural assessment scope have been verified. The claim extends only to those conditions.
- Cannot fire
- Evidence establishes a blocker that prevents the detection from firing within the assessed scope.
- Indeterminate
- The available evidence or the limits of the assessment do not support either conclusion. The unresolved requirement must remain explicit.
Indeterminate is a substantive outcome. It identifies a limit on the claim. Broken and indeterminate detections remain in the assessment totals and must never be counted as verified.
What verification does not establish
A structural CAN FIRE verdict does not establish that a real attack will match the detection, that the right threats are covered, or that an alert will reach an analyst. Detection quality, event matching, execution, alert delivery and response require evidence appropriate to those claims.
A lack of alerts alone establishes neither readiness nor failure. An assessment must distinguish a supported conclusion from an absence of evidence.
How verification relates to validation
Configuration reviews describe settings. Rule tests establish behavior for supplied inputs. Attack simulations establish what happened during a particular exercise. Coverage mappings describe intended detection coverage.
These activities can supply evidence for verification. A verification claim still needs an explicit scope, sufficient evidence and stated limitations. Evidence from one activity does not automatically establish the entire detection outcome.
Independence
Independent verification separates responsibility for assessing a control from responsibility for building or operating it. The assessor must be able to reach an unfavorable or indeterminate conclusion without relying on the control owner’s assurance that it works.
Independence also requires conclusions to remain open to scrutiny. The customer must be able to inspect and challenge the evidence and reasoning. A separate vendor name alone does not establish the quality of a verification claim.
Remediation belongs to the control owner. A claim that a repair succeeded requires fresh evidence and a comparison whose scope and assumptions support that conclusion.