// GLOSSARY

Primary Evidence Object

Each service's real validation product; the decision-closing form of what the ecosystem calls a 'finding'. Security services long described their output by the count of findings; yet a hundred-finding report is a burden if it does not say which work comes first, and a decision if it does. The primary evidence object draws this line: a fix-first backlog in the Application Security Penetration Test, rhythm and measurable closure in the Continuous Penetration Test, a validated attack path in the Modular Red Team Simulation, an abuse path in the Generative AI Red Team. Not a raw list of findings but the evidence that moves the decision. What separates a service from its rivals is not how many findings it reported but what this object is.