Synthetic Value Records Reshape the Framework
I built eight synthetic Value Records through a structured question-and-answer process drawn from my own practice. They forced several changes to the framework, now at v0.6, and gave me candidate metrics to test next.
I built eight synthetic Value Records through a structured question-and-answer process drawn from my own practice: I answered questions about common patterns in security work, and the answers became generic records covering every value category and every evidence tier.
Writing real-looking records forced changes to the framework, now at v0.6:
- Value counts as realized only when the team that did the work and the business that received it agree on the outcome.
- Security claims what it made possible, not the business results that follow.
- Counterfactual benefits, such as delays that might have happened, are noted but not claimed.
- Modeled risk value must include how often an event happens, not only what it would cost.
I also drafted candidate metrics to test next, including Realization Rate (the share of captured records that are confirmed) and Mean Time to Validation (how long confirmation takes).
Update (2026-10-30): framework and records listed as draft artifacts.