// GLOSSARY

Evidence-based Validation

A validation approach derived not from a scan or audit checklist but from real technical or operational observation, measurement, chain or control effect. It is a fixed part of the Red in Pulse category line and the common criterion of all services. The essence of the distinction is this: a scanner's 'high risk' label is a claim, while the safe proof of concept (PoC) that shows the risk is genuinely exploitable is evidence. The distance between the two is the very noise that automated security tools' false positives and context-free severity scores create in the industry. Evidence-based validation filters this noise: a finding is counted as 'validated' only when it is shown in the field, within the previously agreed scope, and without destructive side effects. PTES, NIST SP 800-115 and the OWASP testing methodologies are the established frameworks of this discipline. Without this ground, nothing is called validated; because the only currency of defensible assurance is not a claim but evidence that can be independently reproduced.