Audit cyber control evidence integrity

Audit whether claimed defense in depth is supported by current independent control tests mapped to declared attack-path steps, while preserving duplicate mappings and counting each exposed business asset only once.

Statistical audit & measurement Audit CTOs Tech CEOs IT managers Team leads Investors

What it's for

Turns a control inventory into a board-readable, evidence-backed defense-in-depth audit with explicit business value exposed by stale, failed, shallow or misaligned controls.

What you give it

Inputs split into evidence read from your connected systems, calibration your team owns, and numerical controls that affect precision but never the result's meaning.

Field	Type	Role	Required
as_of_period	integer ≥ 0	Your calibration	Yes
business_assets	array of objects (3 fields) ≥ 1 item	Evidence	Yes
control_path_effects	array of objects (6 fields)	Evidence	Yes
controls	array of objects (6 fields)	Evidence	Yes
max_detail_rows	integer ≥ 1, ≤ 500	Numerical control	Optional
maximum_control_test_age_periods	integer ≥ 0, ≤ 10000	Your calibration	Optional
maximum_uncontrolled_critical_path_fraction	number ≥ 0, ≤ 1	Your calibration	Optional
minimum_distinct_control_stages_per_critical_path	integer ≥ 1, ≤ 4	Your calibration	Optional
minimum_evidence_coverage	number ≥ 0, ≤ 1	Your calibration	Optional
threat_paths	array of objects (6 fields)	Evidence	Yes

Each `control_path_effects` record

Field	Type	Required
control_id	string (non-empty)	Yes
covered_step_id	string (non-empty)	Yes
evidence_verified	boolean	Yes
id	string (non-empty)	Yes
path_id	string (non-empty)	Yes
tested_effectiveness_fraction	number (≥ 0, ≤ 1)	Yes

Example input

{
  "as_of_period": 10,
  "business_assets": [
    {
      "evidence_verified": true,
      "id": "payments",
      "value_at_risk": 100
    }
  ],
  "control_path_effects": [
    {
      "control_id": "access-control",
      "covered_step_id": "initial-access",
      "evidence_verified": true,
      "id": "access-effect",
      "path_id": "credential-path",
      "tested_effectiveness_fraction": 0.6
    },
    {
      "control_id": "detection-control",
      "covered_step_id": "execution",
      "evidence_verified": true,
      "id": "detection-effect",
      "path_id": "credential-path",
      "tested_effectiveness_fraction": 0.5
    }
  ],
  "controls": [
    {
      "control_stage": "prevent",
      "evidence_verified": true,
      "id": "access-control",
      "independently_tested": true,
      "last_test_period": 10,
      "test_passed": true
    },
    {
      "control_stage": "detect",
      "evidence_verified": true,
      "id": "detection-control",
      "independently_tested": true,
      "last_test_period": 10,
      "test_passed": true
    }

Truncated for display — the full payload is 59 lines.

What you get back

This is the actual output of running the example above — computed by the same function the platform calls, not an illustration.

Example output

{
  "assumptions": [
    "Threat paths and attack steps are versioned aggregate architecture hypotheses, not claims about a named adversary. Each business asset value is unique and is exposed once even when several threat paths reach it.",
    "A control counts only when its independent test, evidence and mapped path step are current and the test passed. Combined effectiveness uses multiplicative residual risk; adding percentages or scanner coverage across controls is prohibited.",
    "The audit establishes evidence integrity and defense-in-depth coverage, not control causality, breach absence, regulatory compliance, legal privilege, insurance coverage or a guaranteed loss reduction.",
    "Failed gates never identify employee, vendor, maintainer, customer or attacker intent and do not authorize surveillance, investigation, disclosure, blocking, procurement, employment or production action."
  ],
  "configuration": {
    "as_of_period": 10,
    "business_value_rule": "count_each_asset_value_once",
    "maximum_control_test_age_periods": 1,
    "maximum_uncontrolled_critical_path_fraction": 0,
    "minimum_distinct_control_stages_per_critical_path": 2,
    "minimum_evidence_coverage": 0.95,
    "multi_control_effect_rule": "multiplicative_residual_path_risk"
  },
  "control_diagnostics": [
    {
      "control_id": "access-control",
      "control_stage": "prevent",
      "mapped_critical_path_count": 1,
      "mapped_path_count": 1,
      "test_valid_for_decision": true
    },
    {
      "control_id": "detection-control",
      "control_stage": "detect",
      "mapped_critical_path_count": 1,
      "mapped_path_count": 1,
      "test_valid_for_decision": true
    }
  ],
  "decision": "cyber_control_evidence_integrity_supported",
  "duplicate_control_path_pairs": [],
  "method": "tested_threat_path_defense_in_depth_integrity_audit_v1",
  "path_diagnostics": [
    {
      "asset_id": "payments",
      "combined_tested_effectiveness_fraction": 0.8,
      "critical": true,
      "failed_gates": [],
      "mapped_control_count": 2,
      "path_id": "credential-path",
      "threat_class": "credential-abuse",

Truncated for display — the full payload is 68 lines.

How it works

Statistical audit & measurement — Check whether a number is fit to decide on: coverage, timing, reconciliation, and the gaps a dashboard hides.

1 Freeze unique business assets, versioned threat paths and attack steps, controls, independent tests and control-to-path evidence at one as-of period.
2 Validate freshness, test outcome, evidence, path-step alignment and distinct prevent/detect/respond/recover stages for every critical path; retain duplicate pairs as findings.
3 Gate the claim on evidence coverage and uncontrolled critical-path fraction, union affected assets, and report unique value at risk once rather than once per path.

Before you trust it

Every tool in the catalog ships with the conditions under which its answer is meaningful — and the conditions under which it should abstain instead of guessing.

Assumptions & guardrails

Metric definitions, weights, aggregate grain, sampling, missingness, dependence, and comparison windows correspond to the management claim being audited.
Threat paths are governed aggregate architecture hypotheses, asset values are mutually exclusive, and independent test evidence covers the same control version and period as each claimed effect.
Association, instability, or measurement quality is not a causal effect and must not be converted directly into an individual employment decision.
A failed evidence gate is not proof of compromise, attacker or employee intent, compliance failure or ineffective people, and never authorizes surveillance, investigation, disclosure, blocking, procurement, employment or production action.

Minimum evidence

business_assets: at least 1 rows/items
threat_paths: required and organization-defined
controls: required and organization-defined
control_path_effects: required and organization-defined
as_of_period: required and organization-defined

How to validate it

Validate on future periods or held-out aggregate units, compare with a simple baseline, and require stability across plausible metric definitions and decision thresholds.

Calibrating it to your org

Same for everyone

The mathematical kernel, validation rules, method version, and JSON output semantics are organization-independent; no tenant-trained coefficients or company benchmark is embedded in the function.

Specific to you

one point-in-time aggregate defense graph joining the authoritative asset/service catalog, threat-model version, control registry, independent test record and effect claim without replacing absent evidence with repository activity or scanner counts
asset/value uniqueness and horizon, threat and attack-step taxonomy, control/stage version, test independence/freshness/pass semantics, effect alignment, evidence coverage, defense-depth and uncontrolled-path gates, pseudonymization and accountable security/architecture/finance/risk owners

Calibration workflow

1 Define the management decision, target outcome, aggregate unit, privacy boundary, cadence, and prediction/intervention horizon for this organization.
2 Build a tenant-scoped historical cohort using only information available before each prediction or decision; preserve zero periods, censoring, assignment probabilities, and unresolved outcomes when the method requires them.
3 Estimate statistical parameters on training history, but obtain costs, utilities, risk tolerance, practical-effect thresholds, capacity, and policy constraints from accountable decision owners.
4 Validate on later time windows or held-out aggregate units at the deployment grain, against a simple baseline and the function-specific validation strategy.
5 Deploy only if the returned decision clears evidence, overlap, calibration, robustness, and guardrail checks; warning, unsupported, schema-gap, and fallback decisions are abstentions.
6 Monitor realized outcomes, data drift, coverage, and decision regret; recalibrate at a governed cadence or after a detected regime/definition change, never merely because a stakeholder dislikes the result.

Call it from your AI

You don't wire up 388 tools in your MCP client. The GitRevio MCP server exposes 18 tools, three of which let an agent search the catalog, read a tool's schema, and run it — so the assistant finds this one on its own.

gitrevio_capabilities_search
  { "q": "audit whether claimed defense in depth" }
  → finds "audit_cyber_control_evidence_integrity"

gitrevio_capability_describe
  { "capability_id": "audit_cyber_control_evidence_integrity" }
  → returns the input schema and agent guidance shown on this page

gitrevio_capability_run
  { "capability_id": "audit_cyber_control_evidence_integrity", "arguments": { ... } }
  → returns the result shown above

Works in Claude Desktop, Claude Code, Cursor, Cline, Continue.dev, Goose and Aider. See the MCP server.

Related tools

Forecast cyber control failure loss

Forecast expected and tail cyber loss with locally pooled threat frequency, control reliability and lognormal loss severity, drawing one shared control state across every path it protects to preserve common-mode failure.

Forecasting & survival

Optimize cyber control portfolio

Find a budget-, capacity-, availability- and defense-depth-feasible cyber-control portfolio on a nonlinear attack-path graph, recomputing unique-asset expected loss and CVaR under dependencies, exclusions and multiplicative effects.

Network & dependency analysis

Audit data sovereignty residency evidence integrity

Audit every governed data asset's point-in-time storage, processing, replica, backup, log/cache and key locations plus cross-region transfers against an effective counsel-supplied residency policy, independent evidence, encryption controls and retention limits.

Constrained optimization

Audit software supply chain integrity

Audit the deployed runtime software supply chain from application roots through resolved dependency edges: reconcile SBOM freshness, version resolution, source pinning, artifact attestation, support horizon, license policy, vulnerability disposition, evidence coverage and unique application value without treating repository text as provenance or exploitability evidence.