Status: Accepted Date: Phase 0
The vulnerability-management market is saturated at the detection layer. Dependency scanners are commoditised, largely free, and bundled into source forges by default. An enterprise with a mature toolchain does not lack findings; it has more findings than it can act on, and the marginal scanner adds to that pile rather than reducing it.
The expensive, unautomated work sits after detection: deciding which of several thousand open findings deserves an engineer's week, what specifically to do about each one, and how to defend that choice to an auditor six months later when the evidence that justified it has since changed.
That decision is currently made by senior engineers reading advisories, and it is made under three conditions that make it genuinely hard rather than merely tedious:
- The evidence is incomplete at decision time. A CVE is frequently published before its enrichment, before its CPE, sometimes before a fix exists.
- The evidence keeps changing after the decision. M1 measures NVD records still being modified at a median of (MEASURED) 490.7 days after publication.
- Part of the evidence is a third-party statistical model that is replaced without consumer consent. EPSS is re-trained and re-released on a schedule its consumers do not control. See ADR-0004.
Sentinel takes findings as input and produces defensible, auditable response decisions as output. It does not scan, and it does not attempt to improve detection.
Explicitly out of scope: exploit development, proof-of-concept work, weaponisation research, and any scanning of systems not owned by the operator. The system reasons about the response to public advisories and does nothing offensive.
Accepted: the system is only as good as the feeds it consumes, and inherits every upstream defect. M2 measures one such defect directly and it is severe.
Accepted: the value proposition is harder to demo than a scanner's. A scanner shows a list; this shows a decision and its justification. That places the burden of proof on measurement, which is the point of Phase 0 through Phase 1.
Gained: the problem has a real loss function. A wrong decision has an asymmetric cost — missing an exploited vulnerability is not symmetric with wasting an engineer-day on one that was never going to be exploited — and asymmetric loss is what justifies a decision system over a threshold.
Judgement, not measurement. The market observation is not something we measured, and it is not cited anywhere as a number. What Phase 0 does establish empirically is that the three conditions above are real: M0 (reconstructability), M1 (evidence maturity), M2 (source degradation) and M3A (model instability) each measure one of them.