Demonstrating security performance

An endpoint product may be deployed but excluded from key servers, unable to receive policy or generating unreviewed alerts. Deployment coverage is a useful starting point; it is not evidence of effective detection and response. Sample the configuration and test the response process safely.

For each control, state what was tested and the limits of the test. A tabletop exercise tests decisions and communication; it does not prove that the technical restoration will meet recovery objectives.

Keep the scope and definitions stable when reporting trends. If the estate grows or the scanner gains authenticated access, new findings may represent previously unknown exposure. Explain that change before claiming improvement or deterioration.

Retain the baseline and evidence dates. A reduction in findings caused by decommissioned assets can be genuine risk reduction, but assets disappearing because agents stopped reporting need investigation. Both reduce the total on an unqualified chart.

A vulnerability closed once may reappear after a rebuild, a software reinstall or an unmanaged deployment. Report recurring findings and their causes. The corrective action may be a deployment baseline or ownership change rather than another patch ticket.

Review exceptions for expiry, compensating controls and renewed approval. Repeatedly extending the same acceptance without examining alternatives is not a treatment plan. Directors need to see when this is becoming the normal operating model.

Store test scope, results and follow-up actions in a way another reviewer can understand. Horizon can organise the linked risk records, controls and evidence, but the quality of assurance depends on the tests and judgements behind those records.

Use language that matches the evidence: 'tested on this date with these limitations' rather than 'fully secure'. Independent testing can strengthen assurance, but no report guarantees that an incident will not happen.