Abdullah Bin Zarshaid: security noteshttps://www.abdullahzarshaid.com/research/Original notes on practical security and governance.enA vulnerability title is not an impact statementhttps://www.abdullahzarshaid.com/notes/evidence-before-impact.htmlhttps://www.abdullahzarshaid.com/notes/evidence-before-impact.htmlA finding becomes useful when the reader can separate what was observed, what was demonstrated and what remains untested.A documented control is not the same as an operating controlhttps://www.abdullahzarshaid.com/notes/control-versus-evidence.htmlhttps://www.abdullahzarshaid.com/notes/control-versus-evidence.htmlA policy describes intent. An assurance answer needs evidence that matches the question, the period and the boundary.