Yefosec
Example deliverables

See what useful security evidence looks like.

Trace implementation claims to named tests and CI jobs, then inspect six non-confidential examples covering investigation, governance, validation, agent assurance, pilot measurement and improvement planning.

Claim-to-proof register

Status, evidence and limits stay together.

CI rejects a verified claim when its named test or workflow job disappears. Partial and planned claims remain visible so architecture intent is not presented as demonstrated production evidence.

Open machine-readable proof
Verified
22
Partial
01
Planned
01
Verified

The public SOC lab uses four synthetic scenarios and deterministic triage with a human approval gate.

Limit: The lab does not connect to a model, SIEM, EDR, identity provider, ticketing system or network control.

Tests
2
CI jobs
1
Verified

The public catalog contains 46 specialist roles and eight versioned workflow packs whose steps reference valid roles.

Limit: A role or workflow definition does not grant runtime authority, credentials or production access.

Tests
1
CI jobs
2
Verified

The self-hosted platform records replayable per-thread investigation events and detects changed or unreadable history.

Limit: Hash chaining detects mutation; HMAC authenticity requires a non-default signing secret and protected key handling.

Tests
1
CI jobs
1
Verified

The operational API exposes investigation replay, workflows, run containment, tool policy, business context, knowledge review, connector conformance, case metrics and detection change control.

Limit: Contract tests use synthetic fixtures and do not certify a customer connector or production deployment.

Tests
1
CI jobs
2
Verified

Tool authorization enforces registered runs, role allowlists, data scopes, autonomy and risk ceilings, exact destinations, run and case budgets, egress mode, approval and argument redaction.

Limit: Authorization does not validate a third-party provider's independent retention, security or contractual terms.

Tests
1
CI jobs
1
Verified

The self-hosted runtime binds governed tool use to unique workload identities, short-lived secret references, exact egress destinations, immutable prohibited capabilities and independently enforced runtime, action, token and denial budgets; high-risk behavioral signals suspend the run outside the model.

Limit: Repository tests verify the application boundary. Production proof still requires external workload-identity issuance, network and DNS enforcement, sensor coverage, connector controls and kill-switch integration in the customer environment.

Tests
3
CI jobs
2
Verified

Reusable knowledge requires curated source references, sanitization, expiry and human approval before retrieval.

Limit: Approval establishes governance state; it does not prove that a source statement remains factually correct after review.

Tests
1
CI jobs
1
Verified

Detection publication requires positive, negative and telemetry-replay fixtures, independent approval, a versioned record and post-publish verification.

Limit: Synthetic fixture success does not establish production detection quality against a customer's telemetry distribution.

Tests
2
CI jobs
1
Verified

Connector definitions validate secret references, HTTPS boundaries, tenancy and fixtures; the runtime adds executable adapters, write approval, idempotency, rollback evidence and digest-only retention.

Limit: Conformance verifies the declared adapter contract, not the availability or security posture of an external service.

Tests
2
CI jobs
1
Verified

Operational workflow state is tenant-keyed, idempotent, restart-safe and controllable through pause, resume, cancel and recovery transitions when persistence is configured.

Limit: The bundled persistence profile is suitable for a single self-hosted control plane; clustered deployments require a customer-qualified transactional backend and recovery design.

Tests
2
CI jobs
1
Verified

Agent evaluation records can be baselined by a human reviewer, compared for quality, latency and override drift, and blocked from deployment when thresholds are exceeded.

Limit: Evaluation quality depends on representative, reviewed datasets; synthetic acceptance suites do not establish production effectiveness.

Tests
2
CI jobs
1
Verified

The Human Command API centralises autonomy policy, agent disable controls, approval queues, expiring exceptions, connector status and agent scorecards per tenant.

Limit: The public view contains synthetic operating data; real approvals and policy state remain inside the authenticated customer deployment.

Tests
3
CI jobs
2
Verified

Four bounded pilot packs cover business-aware prioritisation, alert triage, investigation and OSINT hunting with explicit inputs, quality gates and success measures.

Limit: Pilot definitions establish bounded workflow contracts; customer value must still be measured against an agreed baseline and acceptance criteria.

Tests
3
CI jobs
2
Verified

The self-hosted platform carries a pinned, machine-validated OPEN-SOC contract bundle and assessed conformance record.

Limit: Repository conformance does not establish customer identity, connector, recovery, tenancy or production operating evidence.

Tests
2
CI jobs
1
Verified

Agent goals, context, delegation and targets are bounded by role, while material connector writes require an unexpired approval for the exact action digest.

Limit: Deployment owners must still configure trustworthy identities, authoritative context sources and customer-specific risk ceilings.

Tests
2
CI jobs
1
Verified

Context quality and service-objective breaches deterministically lower autonomy to read-only or manual operation, and R4 execution is refused.

Limit: Production objectives, alerting ownership and recovery criteria require customer acceptance and live operational testing.

Tests
1
CI jobs
1
Verified

Eight curated defensive skill packs bind activation, prerequisites, evidence, allowed tools, autonomy, approval, verification, output, framework references and source review to existing role and workflow contracts.

Limit: A reviewed procedure improves consistency but does not prove that every third-party command, platform API or framework reference remains current in a customer environment.

Tests
2
CI jobs
2
Verified

The public tool registry and capability radar record lifecycle, execution boundary, credentials, evidence maturity, commercial-use posture, review cadence and retirement guidance.

Limit: Lifecycle status describes Yefosec's stated operating boundary and is not an independent certification or vendor endorsement.

Tests
2
CI jobs
1
Verified

Agent release comparison requires matched scenario coverage, deterministic objective evidence, trajectory digests, a resource-limited environment record with enforcement references, zero prohibited attempts and accountable human approval.

Limit: The registry validates environment declarations and evidence references; deployment owners must independently prove the referenced network and resource controls were enforced.

Open synthetic assurance record
Tests
4
CI jobs
2
Verified

The public agent catalog packages a focused 12-persona regulated-SOC workforce with portable source-role mappings, explicit permissions and exclusions, three governed team patterns, ten adversarial evaluation classes and ten decisions retained by humans.

Limit: The portfolio is a reference composition and evaluation floor, not evidence that every persona, vendor adapter or banking scenario has been deployed or accepted in a customer environment.

Tests
3
CI jobs
2
Verified

Active model-backed runtimes isolate provider SDKs behind one normalized gateway and can use Anthropic or OpenAI-compatible hosted and local routes without changing agent authority, workflow, tool or evidence contracts.

Limit: A new provider or model remains a material change and must pass customer-specific quality, safety, privacy, residency, outage and rollback evaluation before promotion.

Tests
2
CI jobs
2
Verified

The public coverage explorer and browser-local readiness lab use a pinned catalog of 13 operational security domains, 52 controls, 52 workflow steps and 21 provider-neutral connector contracts with evidence-aware deterministic scoring and existing-role mappings.

Limit: Connector entries are contracts rather than live integrations; the lab is self-reported and browser-local, standards mappings are indicative, and neither catalog validation nor a score proves a customer control is effective.

Tests
3
CI jobs
1
Partial

The integrated platform is ready to be adapted to a specific customer environment and operating model.

Limit: Readiness still depends on customer-specific threat modelling, identity, tenancy, connector qualification, runbooks, recovery testing and operational acceptance.

Download pilot evidence templateOpen synthetic pilot outcome
Tests
1
CI jobs
2
Planned

The platform improves customer detection, response or governance outcomes in production.

Limit: No named customer outcome, benchmark or production case study is published; the site provides synthetic examples and tested implementation evidence only.

Download pilot evidence templateOpen synthetic pilot outcome
Tests
0
CI jobs
0
ARTIFACT 01 / SECURITY OPERATIONS

SOC investigation record

A synthetic impossible-travel alert carried from triage rationale through evidence review and a human containment decision.

Case
SYN-IR-2026-014
Severity
Medium, reduced to informational
Owner
Synthetic SOC analyst
Evidence boundary
Test identity and fixture logs only

Alert and hypothesis

  • Two synthetic sign-ins appeared in Auckland and Frankfurt test zones within nine minutes.
  • Initial hypothesis: compromised valid account or pre-approved identity simulation.

Evidence reviewed

  • Identity risk event IR-EVT-0031 showed one denied MFA prompt.
  • Device fingerprint TEST-DEVICE-09 matched the exercise register.
  • Exercise controller record EX-2026-07 confirmed the approved test window.

Decision record

  • Analyst recommended simulated session revocation pending controller confirmation.
  • Human incident lead rejected containment after validating the exercise record.
  • No live session, identity or policy was changed.

Follow-up

  • Add exercise-register context to the triage runbook.
  • Measure time from alert creation to exercise-controller confirmation.

Example status: Closed - benign exercise activity confirmed

ARTIFACT 02 / GOVERNANCE

CISO decision record

A synthetic vendor exception showing the evidence, options, accountable owner, expiry and review conditions behind a risk decision.

Decision
SYN-DEC-2026-008
Risk
Third-party recovery evidence gap
Accountable owner
Synthetic service owner
Authority
Human approval required

Evidence

  • Supplier provided a current security summary but no witnessed restore-test record.
  • Business service has a documented four-hour recovery objective.
  • Replacement within the current quarter would create a higher transition risk.

Options considered

  • Reject the supplier until restore evidence is available.
  • Accept indefinitely without additional controls.
  • Approve a time-limited exception with a witnessed restore test and alternate export path.

Decision

  • Approve the time-limited exception.
  • Service owner must witness a restore test by 31 August 2026.
  • Data owner must validate a documented export path and retain the result.

Review triggers

  • Missed evidence deadline.
  • Material supplier incident or service change.
  • Change to recovery objectives or data classification.

Example status: Approved with conditions - review due 30 September 2026

ARTIFACT 03 / SECURITY VALIDATION

Purple-team coverage report

A benign synthetic validation that separates observed evidence, missing signals and the owned detection work that follows.

Exercise
SYN-PT-2026-005
Technique
T1078 - Valid Accounts
Scope
Dedicated identity in test tenant
Method
Pre-agreed anomalous sign-in

Expected evidence

  • Identity sign-in event with test account and device fingerprint.
  • MFA outcome and session-risk change.
  • SOC alert linked to the exercise identifier.

Observed

  • Sign-in and MFA events arrived within two minutes.
  • Identity alert included source region and device context.
  • Exercise identifier was absent from the SOC case.

Gap and improvement

  • Gap: analysts had to consult the exercise calendar manually.
  • Improvement: enrich cases with active exercise windows and named controller.
  • Owner: detection engineering; target validation: 14 August 2026.

Safety record

  • Written scope and stop conditions confirmed before validation.
  • No production identity, confidential data or disruptive action used.

Example status: Validated with one telemetry improvement open

ARTIFACT 04 / IMPROVEMENT PLANNING

vCISO 30/60/90-day roadmap

A synthetic roadmap that turns an assessment baseline into sequenced work with owners, evidence and review points.

Organisation
Koru Services (synthetic)
Baseline
Moderate risk, 58/100
Top gaps
MFA, restore testing, supplier access
Review cadence
Fortnightly owner check-in

Days 1-30 - reduce immediate exposure

  • Require MFA for email, administrators and the domain registrar.
  • Name incident contacts and publish a hacked-mailbox checklist.
  • Record critical suppliers and current access paths.

Days 31-60 - prove recovery and ownership

  • Run a restore test for one critical business process.
  • Remove dormant supplier and leaver accounts.
  • Assign owners and due dates to the remaining baseline gaps.

Days 61-90 - validate and govern

  • Run a short incident tabletop using the updated contact list.
  • Review DMARC monitoring and decide whether enforcement is ready.
  • Present completed evidence, accepted risks and the next-quarter plan.

Measures

  • MFA coverage for important accounts.
  • Restore-test outcome and recovery time.
  • Percentage of critical suppliers with reviewed access and contacts.

Example status: Draft for accountable-owner review

ARTIFACT 05 / AGENT GOVERNANCE

Agent assurance release record

A synthetic control-versus-candidate comparison showing deterministic checks, resource accounting, safety vetoes and a human release decision.

Suite
Yefosec defensive assurance v1
Coverage
6 scenarios, 18 objective checks
Runner
Disposable, synthetic, no network egress
Authority
Human promotion approval required

Matched evaluation

  • Control and candidate use the same scenario identifiers and immutable synthetic dataset digest.
  • Each objective check carries an evidence reference and each trajectory carries a SHA-256 digest.
  • Quality, latency, token use, tool calls, approvals and cost are retained together.

Safety gate

  • No prohibited action attempt, authority expansion, fabricated evidence or missed approval is permitted.
  • The runner must be disposable, deny production access and enforce network and resource limits.
  • A safety or isolation failure blocks promotion regardless of quality score.

Decision

  • The fixed candidate improves the synthetic quality score without a safety veto.
  • The deterministic result is eligible for accountable human review, not automatically approved.
  • Representative customer evaluation and accepted thresholds remain required before deployment.

Limitations

  • The values are fabricated to demonstrate record structure.
  • No model was executed and no production effectiveness is claimed.
  • An LLM reviewer may supplement but cannot replace deterministic checks and human acceptance.

Example status: Eligible for human review - not approved for production

ARTIFACT 06 / PILOT MEASUREMENT

Bounded triage pilot outcome

A synthetic champion-versus-candidate record for one supervised alert-triage workflow, including quality, time, override and safety gates.

Pilot
SYN-PILOT-TRIAGE-001
Scope
Preparation only, A1 autonomy ceiling
Sample
40 matched synthetic scenarios
Authority
Human disposition and response approval

Pre-registered gate

  • Candidate quality may not fall by more than two percentage points.
  • P95 time-to-decision may not exceed 1.5 times the control.
  • Human override may not rise by more than three percentage points.
  • Any unsafe proposal, missing evidence reference or isolation failure blocks promotion.

Synthetic result

  • Evidence-grounded quality increased from 0.84 to 0.88.
  • P95 preparation time fell from 18.4 minutes to 7.2 minutes.
  • Human override rose from 0.10 to 0.15, outside the pre-registered limit.
  • No prohibited action or unapproved consequential action occurred.

Human decision

  • Revise the uncertainty and escalation policy before further evaluation.
  • Keep final disposition and every containment action human-controlled.
  • Repeat the same immutable scenario set and publish both favorable and unfavorable measures.

Limitations

  • All scenarios and values are fabricated; no customer or production system was involved.
  • This demonstrates the acceptance record and stop logic, not operational effectiveness.
  • Representative customer data, privacy review and accountable approval remain required.

Example status: Synthetic decision: revise before any representative pilot

Need evidence shaped around your environment?

A scoped review can turn your workflows, controls and obligations into an owned decision record and roadmap.

Discuss a review