Evidence Assurance Platform

Turn assessments into a defensible evidence system.

Collect evidence. Classify it honestly. Route human review. Produce assessment records you can replay when someone asks, six months later, why a control was marked satisfied.

  • Collect evidence
  • Classify it honestly
  • Route human review
Run a pilot assessmentSee the arithmetic

One real assessment, instrumented alongside your existing process. You keep the work product either way.

Evidence coverage, this engine, today

Machine-proven
6 of 110
Routed to human review
103
Assessment points machine-supported
18 of 313
Points requiring a credentialed human
295 (94%)

Published from the engine, not written by hand. If a rule changes and this number is not regenerated, our build fails.

Five states. Absence is not failure.

If the evidence cannot establish the claim, Scrutexity does not manufacture certainty. Every control carries a state and a defined next action, so your assessor knows whether to collect, corroborate, remediate or judge.

PROVEN

Evidence establishes the claim.

Nothing further.

REFUTED

Evidence establishes the claim is false.

Remediate.

INFERRED

Evidence suggests it but does not settle it.

Corroborate.

HUMAN REVIEW

No telemetry can decide this either way.

Assess.

UNPROVEN

The evidence required to decide is absent.

Collect.

AI proposes. Evidence proves. Humans decide.

We are not competing with your assessors.

We are deleting the data entry underneath them. Traditional 800-171 assessments can involve substantial manual evidence collection, review, and rework.

Live today

  • Evidence collection

    Read-only harvest of Microsoft and Windows configuration, every artefact hashed and dated at capture.

  • Evidence classification

    Five states, each with a defined next action. Absence is never converted into a passing claim.

  • Human review routing

    103 controls arrive with the relevant configuration already attached.

  • Replayable records

    Every decision keeps its evidence, reviewer and timestamp, so a challenge months later is answerable.

  • Assessment scoring

    Deterministic SPRS baseline, fail-closed, with every deduction traceable to a control.

Next: multi-source

  • SSP comparison

    Compare what the system security plan asserts against what the configuration shows.

  • Prior assessment comparison

    Compare the current record against what the last assessment concluded.

  • Contradiction detection

    Surface disagreements between authoritative sources for human assessment.

  • Assessment Autopsy

    Ask where a completed assessment would break if it were challenged tomorrow.

Contradiction detection requires a second evidence source. Today the engine reads configuration telemetry only, so it can tell you what the environment shows but not yet where the environment and the paperwork disagree. We would rather label that than let you infer it.

What we refuse to claim.

Every vendor approaching you right now is claiming coverage. Ask them which controls their engine refuses to score. This is ours, and it is enforced by tests rather than by intention.

  • We do not mark a control satisfied because a policy document says it is satisfied.
  • We do not infer operational execution from configuration state.
  • We do not grant partial credit outside the two requirements where the DoD Assessment Methodology allows it.
  • We do not produce a score at all when the system security plan is missing. That is a finding, not a zero.
  • We do not count a rule as coverage when no collector returns its evidence.

If we can’t prove it, we don’t score it.

We don’t hide the ugly math.

Assessment scoring is not the same thing as evidence coverage, and conflating them is how tools end up overstating what they know. SPRS runs from +110 to -203, so there are 313 points of deductions in play. Run our engine against a flawless environment and it recovers 18 of them. The score lands at -185.

That is not our product failing. It is the honest ceiling of configuration telemetry. The remaining 295 points, 94% of the assessable value of every account, require a credentialed human working a queue we assemble with the evidence already attached. That queue is your billable work, and it is not going away.

Machine-proven controls, by identifier

3.1.10 · 3.1.11 · 3.1.8 · 3.13.11 · 3.14.2 · 3.5.3

Four further rules are written and unregistered, waiting on collector work. We do not count them, because a rule whose evidence no collector returns raises our number and moves your client’s score by nothing.

Run one assessment. Measure it against your own.

Not a licence, not a platform commitment. One real assessment, instrumented alongside your existing process, so the comparison is made with your data rather than our marketing.

What gets measured

  • Assessor hours per control
  • Evidence requests raised, and how many were rejected
  • Rework events and first-pass resolution rate
  • Controls resolved by machine versus routed to a human
  • Contradictions surfaced between sources
  • Time from intake to an assessment-ready record

What you keep

The assessment work product, the sealed evidence record, and the instrumentation report, whether or not you continue. If the numbers do not move, that is a result worth having and we would rather you learn it in one engagement than after a year of licence fees.

Start a pilot assessment