// GLOSSARY

Verifiable Closure

The proven form of a 'fixed' claim, demonstrated by re-measurement, revalidation (re-test) or control-effectiveness tracking. The quietest failure in security work hides here: a vulnerability is assumed closed, yet the patch was applied in the wrong place, opened a new weakness, or merely masked the symptom. Verifiable closure ties this assumption to a measurement; within the fix-verify cycle it rests closure on evidence, not a word. It is the backbone of rhythm-based closure visibility in the Continuous Penetration Test, and the mean time to remediate (MTTR) carries meaning only when set on this ground, because the duration measured must run to the moment of 'verified as closed', not 'said to be closed'. Whether a finding is truly closed is told not by the one who claims it but by independent measurement; the gap between the two is the threshold that determines the report's credibility.