[ PROOFECONOMY ]™GlossaryOriginSpecsOpen Control
An Open Control is a security control whose rules, configuration and deployed state are published or fingerprinted, so anyone can see exactly what was tested and confirm that the control in production is the same one that was proven.
What it means
A test result is only as useful as your ability to say what was tested. “Product X stopped the attack” means little if nobody can tell which version, which rule set, which policy and, for AI controls, which model, prompt and tool permissions were in place.
An Open Control makes that knowable. Its definition is either published in full or captured as a fingerprint: an independent hash of the exact deployed state of the control.
Open Control and Open Verification
The two are counterparts:
| What is open | What it lets others check | |
|---|---|---|
| Open Verification | The method and records of the check | How the result was produced |
| Open Control | The control’s definition and deployed state | What the result applies to |
Both are more transparent than their closed versions. Neither is proof on its own. Proof still requires an independent witness of the outcome. See Proof of Efficacy.
Why it matters
- Proof stays attached to the right thing. A result is tied to the control’s fingerprint. Change the rules, the policy or the model, and the fingerprint changes, so the old proof is marked stale until the control is proven again.
- Silent drift becomes visible. If measured behavior changes while the fingerprint stays the same, something changed that nobody declared.
- Single controls can earn credit. With each Control Under Test fingerprinted, a result can be attributed to one rule or detection, not just to the product as a whole. See SUT, DUT, CUT and AUT.
Open does not mean public rules
A vendor does not have to publish its detection logic to run an Open Control. A fingerprint committed before the test is enough: it proves the deployed control was the tested control, without revealing what is inside it.
Example
A web application firewall is tested and stops 94 of 100 attack techniques. The result is tied to the fingerprint of its version, rule set and policy. A week later the vendor pushes a rule update. The fingerprint no longer matches, the 94-of-100 result is marked stale, and buyers can see that the control they are running is no longer the one that was proven.
Related terms
- Dead Canary Protocol (ProofSwarm)
- Open Verification
- Proof of Control
- Proof of Efficacy
- SUT, DUT, CUT and AUT
- Verification of Control