Validation module
04 / 07Security Control Validation
Shows whether your deployed controls prevent, detect, alert on or miss real attacker actions in your environment.
The problem
Coverage is assumed, not measured
A control catalogue says which categories are deployed. It does not say whether a given technique would be stopped in your configuration. Detection content degrades through tuning, exclusions and upgrades; a rule that fired at deployment can stop firing without any alert announcing it. Coverage percentages derived from a product's own documentation describe what it can do in principle, not what your instance did yesterday.
The result is a posture that looks complete on a slide and has specific, unknown holes in practice. Those holes are discovered either by Veync or by an adversary.
How Veync tests it
Evasion-aware exercise of each control category
Veync executes real attacker actions against the control categories you have deployed, with evasion-aware tradecraft rather than signature-friendly test cases, and observes what each control actually did. The subject is always the control category — endpoint, network, email, data, application, identity, operational and physical telemetry — never a named product.
What this module covers
- Endpoint detection and response
- Network detection and response
- SIEM detection content
- Email security
- Data loss prevention
- Web application firewalls
- Identity and multi-factor enforcement
- Operational-technology telemetry
- Physical and airspace telemetry
What you receive
A verdict per control, with timings
You receive a prevented, detected, alerted or missed verdict for every control in scope, the executed action behind each one, measured detection and response times, and the specific detection-engineering changes that would close each gap.
Prevented, detected, alerted or missed, per control
Measured detection and response times
The detection-engineering changes that close each gap
Per-control verdicts
- Prevented
- Detected
- Alerted
- Missed
Every control in scope receives one of these four verdicts, with the executed action that produced it. A control that was never exercised is reported as untested rather than as passing.
Response measures reported
- Mean time to detect (MTTD), per technique and per control
- Mean time to respond (MTTR), from detection to containment
Standards
Evidence from this module maps to
MITRE ATT&CK
MITRE
Put this module to work
A validation briefing covers scope, the authorization you would sign, and the evidence this module would produce for your environment.
Named-vendor results and control-evasion evidence are shared under NDA, through the evidence annex.