[ PROOFECONOMY ]™GlossaryOriginSpecsOrigin of the Proof Economy
The Proof Economy names a practice that came first: testing whether a security product does what its vendor says, under real adversarial pressure, and judging it by the outcome instead of the vendor's demo. Craig Thomas Ellrod did that work for years before he named it.
The problem: demos that know the answer
In 2023 Spyderbat put its product in front of red teamers at theWorld Hacker Games. Afterwards a Spyderbat product leader described what was wrong with the way security is sold. In a scripted demo, he said, "the demo'er already knows the script", so demos "suffer from 'knowing the answer'". The alternative was to let red teamers attack the product live with their own tools: "Put your product in a live attack environment, and show how it works."
A test whose outcome the presenter already knows proves nothing. Everything since is built to take that knowledge away: canaries committed before the run, witnesses that cannot see which attacks are real, and outcomes judged outside the vendor's own console. That is Proof of Efficacy, and an economy that buys on it is the Proof Economy.
Timeline
| Date | What happened | Evidence |
|---|---|---|
| 2007 | WAF Test Methodology, WebAppSec.org, co-authored with Ivan Ristic, Amit Klein, Bob Walder, Lior Cohen and Spirent: testing a security product against attacks instead of its datasheet. | Public |
| 2008 | Technical Marketing (ISBN 978-0-9822570-0-5) documents System Under Test and Device Under Test competitive testing. | Public |
| 18 January 2022 | The same attack run against a target with the security control present and with it absent, both scripts committed together. | GitHub commit ec0178d |
| 1 June 2023 | Seven videos for the Spyderbat engagement at the World Hacker Games uploaded to YouTube. | YouTube upload dates, captured with an RFC 3161 timestamp |
| 30 June 2023 | SPYDERbat vs. Cluster of PODs: red teamers attack Spyderbat's product live with their own tools, in place of a scripted demo. | YouTube premiere |
| 24 August 2023 | Second round, live: Spyderbat vs Silent Bob. | YouTube |
| September 2023 | A Spyderbat product leader records a testimonial: scripted demos "suffer from 'knowing the answer'". | Testimonial notes and clips, byte-identical to Dropbox server copies of 9 October 2023 |
| 18 September 2025 | CAE (Continuous Autonomous Evaluation) published as a category. | Internet Archive, 6 October 2025 |
| 25 September 2025 | The Proof Economy published as a category: proof is the new currency. | Internet Archive, 6 October 2025 |
| 23 October 2025 | The Proof Economy Manifesto. | Internet Archive, 9 November 2025 |
| 10 July 2026 | Proof Economy Universal Framework and Prior Art Declaration. | Zenodo DOI 10.5281/zenodo.21379780 |
| 13 October 2026 | The Dead Canary, Jailed Canary, Coal Mine and Pithead protocols (PP-SPEC-077 to 080) formalize the method. | Zenodo DOI 10.5281/zenodo.23347914 |
| 19 October 2026 | Proof Economy Glossary, dated snapshot. | Zenodo DOI 10.5281/zenodo.23478571 |
Check it yourself
Every date above is held by someone other than the author: GitHub, YouTube, the Internet Archive, Zenodo or Dropbox. The full record, with SHA-256 hashes of the 2023 files, what each kind of evidence does and does not prove, and how to verify every entry, is public at PROOF-OF-EFFICACY-LINEAGE-PUBLIC.