Methodology and Trust

Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.

The Risk Assessment is built to under-claim. Given the choice between a flattering summary and an honest gap, it shows the gap. There is no single "risk score" and no green "all clear" — on purpose. That restraint is not a missing feature; it is the property that makes the report defensible. This chapter is written for the reader who has to stand behind the numbers: the CISO briefing a board, the risk manager reconciling a register, the compliance or audit officer who needs to know exactly what the report does and does not assert.

This chapter is about why to trust the numbers. For how to read the bands, the likelihood × impact matrix, and the coverage posture, see Reading the Report.

Grounded in your model, and reproducible

The report is produced from your own threat model, and nothing else. There is no AI making judgment calls, no external threat-intelligence feed, no vendor benchmark, and no industry dataset blended in behind the scenes. Every band, every count, and every coverage ratio resolves to something you modeled — an element, a data flow, a control, a boundary, a technique mapping. Nothing arrives from outside your model, so there is no third-party data whose provenance, currency, or licensing an auditor would need to question.

Because the report draws only on your model and does no guessing, it is reproducible. The same model produces the same report, every time. Generate it today, and generate it again next month over an unchanged model, and the two are identical — line for line, band for band. Nothing in between can quietly move a number: no model that "learned" something new, no feed that shifted overnight. This is the single most useful property to hand an auditor: give them the model, let them regenerate, and they get your report back, byte for byte.

Reproducibility also makes the report honest about time. A Risk Assessment is a snapshot, bound to the exact state of your model at the moment you generated it. If the model changes afterward — someone adds a component, reclassifies a data item, declares a new boundary — the report notices and tells you, raising a notice that your model has changed since the report was generated. The remedy is to regenerate. You are never left holding a stale report that silently disagrees with the model it claims to describe. (For the notice itself and how it behaves, see Reading the Report.)

The report also depends on the ATT&CK/D3FEND reference data loaded on the platform, so it checks that too. When the reference data is updated, the report works out whether the update could have changed anything it concluded. If it provably could not — your model's assessed inputs are unchanged, so no coverage verdict moved, and only displayed details such as technique names, published mitigations, or reference links may be dated — the notice is informational, not the amber alarm. Recreate when convenient to pick up the current details. If the update did move the assessment inputs, or the report cannot tell whether it did, the notice stays amber: recreate before you cite the report.

What the numbers mean — and what they don't

Four disclaimers travel with every Risk Assessment, and they are carried onto the governance versions of the report as well (see Stakeholder Reports). They are not legal boilerplate to scroll past — each one tells you precisely how far a number may be pushed in a conversation, and how far it may not. Read them as the boundary of what you are entitled to assert on the report's authority.

The fourth disclaimer — no assurance — is carried on every version of the report, including the most detailed technical export. The most assertive artifact never carries a weaker caveat than the board deck. That symmetry is deliberate: whichever version of the report leaves your hands, it states its own limits.

Why there is no single score, and no green

You will not find one headline risk number in a Risk Assessment, and you will not find a green "you're safe" state anywhere in it. Both absences are chosen.

A single rolled-up score would hide the gaps that matter. The moment ten findings collapse into one number, the two critical exposures average away against eight low ones, and the report starts telling a story that is comfortable rather than true. So the report keeps its signals segregated. Findings are ranked into bands; an element's band is the highest of its findings' bands, never a blend that dilutes the worst case; roll-ups are shown as distributions — how many findings sit in each band — never as a sum. Nothing flattering hides behind an average, because there is no average to hide behind.

There is no green because the report cannot see your live environment. It knows what you modeled; it does not know what is running. Painting any part of the report "safe" would assert something it has no standing to assert. So where a control is present, the report shows it as present — a real, positive signal — but it never escalates that into an all-clear. And where the report cannot tell, it says so plainly: an unmeasured finding reads as unknown, never quietly filed under "low," and a place where coverage is undetermined is shown as undetermined, never rounded up into "covered." Absent evidence is shown as absent.

This is where under-claiming earns its keep. In front of a board or an auditor, the credible report is the one that volunteers its own gaps. A tool that only ever shows green invites the question "what aren't you seeing?" — and has no answer. A Risk Assessment answers that question on every screen: here is what I found, here is what I could not determine, and here is exactly where I stopped. That is a far stronger position to defend than a reassuring dashboard.

Evidence and provenance

Every finding is traceable to what produced it. A finding names the modeled elements, flows, and techniques it rests on, and you can follow each one back to its place in your model. Nothing appears without a stated basis. (For navigating from a finding to its evidence, see Understanding Findings.)

Three principles govern how that evidence is presented, and each one exists to keep you from over- or under-reading it:

• Absence of a citation is not absence of basis. Some findings cite an external framework and some do not, and the difference is about what a public source happens to have published — not about whether the finding is sound. A finding without a visible citation is not a finding without grounds. The report says this out loud wherever sources appear, so a reader never mistakes lighter citation for weaker validity.
• Synthesis is labeled as synthesis. Where a technique mapping is Dethernety's own reasoning rather than a mapping the framework itself published, the report says so, right next to the mapping. You are never handed a synthesized link dressed up as an authoritative one — so you can present each to an auditor for exactly what it is.
• Guidance names a candidate, not a cure. Where the report suggests the class of control a gap concerns, it presents it as a candidate class — the kind of control the gap is about — never as a specific product and never as a claim that adopting it changes the rating.

That last point deserves its own emphasis, because it is the single principle most often misread: having remediation guidance is not the same as a risk being fixed. The report can tell you exactly what to change on an element to clear a finding. It will never let that guidance read as a claim that the change has been made, is scheduled, or has lowered the risk. Guidance tells you what to change; only changing the model and regenerating actually moves a rating. As the report itself puts it wherever it offers guidance: applying a control is a model change — recreate to see its effect on this rating.

To keep that line from ever blurring, the report holds itself to a strict vocabulary. It describes changes to make; it never announces that a finding has been dealt with.

The distinction between a management decision about a risk and a computed fact about a finding is preserved throughout, and the two are never merged or summed. Where you record how you intend to treat a risk, that decision lives in the register alongside — never inside — the computed finding. See The Risk Register for how those authored decisions sit next to the analysis without ever altering it.

Defending this report

When you take a Risk Assessment into a board meeting, a regulatory conversation, or an external audit, these are the properties you can stand behind without qualification:

• It is reproducible. Hand over the model and anyone can regenerate the exact report. There is no hidden state and no run-to-run drift to explain.
• It is grounded. Every number resolves to something in your model. Nothing is inferred from outside data or from an AI's judgment, so there is no external source whose reliability you have to defend.
• It is bounded. The report states its own limits on every version, and the strongest caveat — that this is not an audit and asserts no control effectiveness — is present even on the most technical export.
• It is conservative. Where it cannot tell, it shows the gap rather than a comforting default. It under-claims by design, so the honest reading is always the one on the page.

Used this way, the report's restraint becomes your strongest argument. It does not ask anyone to trust a number on faith; it shows the basis for the number, states the limits of the number, and can be regenerated to prove it. A tool that volunteers its own gaps and refuses to overstate its own reach is precisely the tool an auditor is inclined to believe.

Where to go next

• Reading the Report — how to read the bands, the likelihood × impact matrix, and the coverage posture.
• Understanding Findings — following a finding back to the evidence that produced it.
• Stakeholder Reports — the Board and Risk Committee versions, and the disclaimers they carry.
• The Risk Register — recording management decisions alongside the analysis without altering it.
• FAQ — common questions about trust, scope, and defensibility.