Observed, inferred, validated, verified: how SCARP grades its own evidence

Security reports tend to present every line item with the same visual confidence: a bullet, a severity tag, a short description. Read that way, a directly witnessed exposure and a modeled probability look identical, even though a reader should trust them differently. SCARP labels how each finding was obtained for that reason — not to hedge, but to tell the reader how much weight a specific claim can carry.

Observed evidence comes from passive external observation — something SCARP saw directly from outside the perimeter, like a public administration panel that shouldn't be internet-facing, or a certificate that has already expired. It's the strongest grade a passive run can produce, because it doesn't depend on a model of how something behaves; it's a fact about what's reachable right now.

Inferred evidence is a reachability correlation — a connection SCARP's model draws between two observed facts rather than something it watched happen directly. If an exposed sign-in page and the identity policy behind it are both observed, the route from there to the systems that policy protects is inferred: an outside-in scan can't see behind the perimeter, so that hop is probable and well-supported, but a step removed from direct observation, and graded with a correspondingly lower confidence.

Validated evidence comes from an active check the customer has explicitly authorized — a targeted probe that confirms a specific finding is real rather than theoretical. It costs more to obtain than passive observation, which is why it's reserved for claims that matter enough to justify asking permission first — and why it's the strongest grade before a fix ships.

Verified evidence is the retest result after a fix ships: the findings the path was built from, checked again, with an answer about whether the route is still there. It's the only grade that describes a path's status after remediation rather than before it.

Each piece of evidence in a report carries a confidence percentage and a freshness timestamp alongside its kind. An observed fact from this morning earns a high confidence because it's both direct and current. An inferred connection carries a lower percentage, because it's a correlation rather than a direct read. Freshness matters on its own: an accurate observation from months ago says less about today's exposure than a lower-confidence read from this week, and a report that omits the timestamp is asking the reader to assume it doesn't matter.

A vendor grading its own evidence sounds like it should be self-serving — why would anyone underclaim their own findings? The answer is that a security lead deciding what to fix first needs to know which claims to lean on and which ones to treat as a starting hypothesis. Presenting every finding as equally certain doesn't make a report more convincing; it makes it harder to act on, because the reader has no way to tell which line items are load-bearing. An evidence register that distinguishes observed from inferred, and inferred from verified, is what lets someone build a decision on top of it instead of just reading it.