[ PROOFECONOMY ]™GlossaryOriginSpecsSUT, DUT, CUT and AUT
SUT, DUT, CUT and AUT are the four levels at which a test result can be attributed: the Solution Under Test (the whole deployment), a Device Under Test (one product inside it), a Control Under Test (one rule or detection inside a device), and an Agent Under Test (an agent whose own conduct is being tested).
The four levels
| Level | Term | Scope | Example |
|---|---|---|---|
| Solution | SUT | The full deployment under test | A production agent stack with its network, identity and data stores |
| Device | DUT | One security product, configuration or guardrail inside the SUT | An EDR, a WAF, an agent policy layer |
| Control | CUT | One control inside a DUT | A single rule, policy, signature, detection or guardrail function |
| Agent | AUT | One agent inside the SUT whose own conduct is under test | A coding agent, an MCP-connected assistant, one member of an agent swarm |
An SUT contains one or more DUTs and any number of AUTs. A DUT contains one or more CUTs.
Devices stop attacks. Agents may commit them.
A DUT is a defender: the question is whether it stopped the attack. An AUT is an actor: the question is whether it stayed inside its Declared Policy. The same test harness can measure both, but they are different questions.
Credit to a single control is earned, not reported
A device log naming the rule that fired is not enough to credit that rule. A result can be attributed to a single CUT only by differential attribution: matched runs in an otherwise identical SUT, with that control active and with it disabled, using fresh variants of the same technique. The attack must land with the control off and fail with it on.
Where the terms come from
DUT and SUT come from the competitive test methodology in Craig Thomas Ellrod, Technical Marketing (2008), ISBN 978-0-9822570-0-5, Chapter 4, “Competitive Test”, which defines a competitive test as a device or solution under test together with the testing equipment. Its baseline practice of testing with and without the device is the basis for differential attribution. PP-SPEC-077 extends the model one level down (CUT) and one step sideways (AUT).