Verification
Verification is a system or vendor confirming its own claim from its own records. It is an acceptable baseline, not proof.
What it means
Verification answers the question: does the system say it did what it claims? The evidence comes from the system’s own logs, reports, dashboards or attestations.
That is useful. It is the first thing any buyer or auditor should check. But the system is speaking for itself, so verification cannot rule out the case where the system is wrong, misconfigured or simply reporting success it did not achieve.
Where it sits
Verification is the bottom rung of the evidence ladder:
- Verification: the system confirms its own claim.
- Validation: the claim is tested against defined conditions.
- Proof of Efficacy: independent evidence that the required outcome was produced.
See the full ladder: Verification vs. Validation vs. Proof.
What it does not show
Verification does not show that an attack was stopped, that a risk was reduced, or that the result would hold under real conditions. It shows that the system reported something.
Example
A security tool’s dashboard shows “100% of endpoints protected.” That is verification. It tells you what the tool believes about itself, not what happens when an attacker tries.