[ PROOFECONOMY ]™GlossaryOriginSpecsVerification vs. Validation vs. Proof
Verification is a system speaking for itself. Validation is a claim put to a test. Proof is independent evidence that the required outcome was produced. Most security evidence today stops at the first rung.
The evidence ladder
Ranked from weakest to strongest evidence. Each rung can be true while the product still fails; only the top rung settles whether it worked.
| # | Term | The question it answers | Where the evidence comes from |
|---|---|---|---|
| 01 | Verification | Does the system say it did what it claims? | The system's own records |
| 02 | Verification of Control | Is the control there? | The control's own configuration and status |
| 03 | Open Verification | Can others inspect the system's own records? | The system's own records, published |
| 04 | Proof of Control | Did the control act? | A log or event showing the control fired |
| 05 | Validation | Does the claim hold when tested? | A test against defined conditions |
| 06 | Proof of Efficacy | Did it produce the required outcome, under the required conditions, at a standard good enough to matter? | Independent evidence of the outcome |
Why the difference matters
A control can be in place, report healthy, and evenfire during an attack, and the attack can still succeed. Buyers, insurers and boards that accept verification as evidence are accepting the vendor's word. The higher the stakes, the higher up the ladder the evidence needs to come from.
Verification is not proof
Making verification open improves transparency but does not change its source: the records still come from the system under review. Moving up the ladder requires two things verification cannot supply: a test against defined, realistic conditions, and evidence independent of the system being judged. That is what Proof of Efficacy requires.