QILAHK™ / EVIDENCE & PROVENANCE

What Makes Security Evidence Trustworthy?

A practical way to examine the origin, scope, integrity, and freshness of evidence before relying on it.

October 12, 2026 · QILAHK Journal

Start with the claim

A report can contain thousands of observations and still leave the central question unanswered. Before collecting evidence, state the claim precisely: which asset, which property, which environment, and which period are being assessed? “This device is secure” gives a reviewer little to test. “This identified device met the approved boot configuration criteria at the recorded observation time” sets a boundary that evidence can address.

In the QILAHK trust model, evidence supports a defined claim. Its value depends on the relationship between what was observed and what the decision needs to establish.

Keep the origin attached

A useful evidence record identifies its source, collection method, subject, timestamp, and relevant tool or procedure version. It should also explain how the subject was identified. A hostname alone may be ambiguous after a device is renamed or replaced.

Preserve the original artifact alongside any normalized values. Normalization makes review easier, but a transformation can omit context. Reviewers need to distinguish what the source reported from what an interpretation added.

Integrity is one part of the answer

A hash can help detect changes to an artifact when compared with a trusted reference. It does not establish that the original observation was accurate. A signed artifact can bind a statement to a signing key, but the reviewer still needs to assess the signer’s authority and the collection process.

Treat integrity, authenticity, relevance, and completeness as separate questions. Strong evidence in one dimension should not silently compensate for an unanswered question in another.

Use a practical evidence test

Ask whether another authorized reviewer could identify the subject, reproduce the interpretation, understand the limitations, and locate the applicable criteria. Record gaps explicitly, including stale observations or missing collection context.

For example, a configuration screenshot may be useful background while remaining insufficient for a claim that requires authenticated device evidence. The appropriate outcome is to request the missing proof or narrow the claim. A defensible trust decision makes that boundary visible.

Continue exploring the foundations in Cybersecurity Has Security Controls. What It Lacks Is a Trust Layer.