Evidence Ladder

The Evidence Ladder ranks security work by how much verifiable proof it produces, not by how clever the tooling is. Rung one is a scan result: a finding exists. Rung two is a fix with a timestamp. Rung three is an independent audit someone outside the agency can read. Agencies climb the ladder because client procurement and insurers increasingly ask for artifacts, not assurances. A concrete example: Anthropic gave METR employee-level access to review its models and waived the right to block publication, converting an internal safety claim into a third-party record. That is rung three behavior, and it is the standard enterprise buyers now carry into vendor reviews. For an agency, the ladder reframes security from a cost center into a retainer line: quarterly scans from a scanner such as Sentrint or Aikido sit at rung one, while signed remediation logs and external review justify a recurring compliance fee. Promise the rung you can document, never the rung above it.