Overview
Good findings depend on good evidence, and evidence quality determines whether findings are credible and actionable. This lesson covers what makes evidence high-quality.
Learning objectives
- Define evidence quality attributes.
- Explain why quality matters for findings.
- Apply quality standards to collection.
Core concept
High-quality evidence is accurate, reproducible, clear, complete (enough to prove the finding), and responsibly handled. It shows unambiguously that a finding is real and demonstrates its impact, letting the owner confirm it and developers fix it. Quality attributes include: it proves the specific claim; it includes reproduction steps; it is unaltered and trustworthy; it is minimal-but-sufficient (no unnecessary sensitive data); and it is well-organized and tied to the finding. Poor-quality evidence (vague, unreproducible, or excessive) undermines the whole assessment.
How it works
For each finding, the tester captures evidence meeting these standards: the artifact(s) proving the issue (e.g. request/response, output, screenshot), the steps to reproduce, and the observed impact — accurately and without alteration. Evidence is minimal but sufficient: enough to prove the point, with sensitive data redacted/minimized, and no more. It is clearly tied to the finding and organized for the report. High-quality evidence is captured at the moment of discovery (for accuracy) and handled per the rules of engagement. These standards make findings trustworthy and remediation efficient.
Practical example
For an access-control finding, high-quality evidence includes: the exact request that triggers the issue, the response demonstrating unauthorized access (sensitive values redacted), clear reproduction steps (authenticated as user A, request user B's resource), and a statement of impact. It is accurate, reproducible, minimal (no full data dump), and tied to the finding. A low-quality alternative — a vague claim with no reproduction or an over-collected data dump — would be far less credible and useful. The quality attributes made this finding actionable.
Cybersecurity relevance
Evidence quality is what makes findings credible, verifiable, and actionable — the difference between a report the owner trusts and acts on, and one they dismiss. It underpins accurate severity, efficient remediation, and remediation verification. Responsible, minimal handling of sensitive data within evidence is also an ethical/legal requirement. This lesson frames the specific evidence elements — timestamps, screenshots, logs, integrity, chain-of-custody — covered next, all of which serve overall evidence quality. High-quality evidence is a hallmark of professional assessment.
Common mistakes
- Vague or unreproducible evidence that doesn't clearly prove the finding.
- Over-collecting sensitive data rather than minimal-but-sufficient, redacted evidence.
- Capturing evidence late or altering it, undermining accuracy and trust.
Key takeaways
- High-quality evidence is accurate, reproducible, clear, complete (minimal-but-sufficient), and responsibly handled — proving a finding and its impact.
- It includes proof artifacts, reproduction steps, and impact, captured at discovery, tied to the finding, with sensitive data redacted/minimized.
- Quality makes findings credible and actionable and underpins severity, remediation, and verification; it is a hallmark of professional assessment.
Check your understanding
- What attributes make evidence high-quality?
- Why does "minimal but sufficient" matter for evidence, especially regarding sensitive data?