FIELD GUIDE / AZION LABS
Understand security posture through evidence and scope
Net Fortress is a defensive desktop security project at Phase 0. Its foundation includes authorization boundaries, a finding model and an audit log. Real host checks are a later phase; this reference explains the intended assessment discipline.
By AZION LabsUpdated:
Who this is forDevice owners and teams learning how to read authorized security findings and plan remediation.
Define what was actually assessed
An assessment needs an authorized asset list, an observation time and a description of the checks performed. A missing permission, unsupported system or unavailable check creates an unknown, not a passing result. Net Fortress’s foundation makes this distinction explicit. Its Phase 0 status should remain visible wherever assessment capability is described.
Place findings within the wider security program
NIST CSF 2.0 groups cybersecurity outcomes into six concurrent functions: Govern, Identify, Protect, Detect, Respond and Recover. A host finding can inform part of that picture; it cannot prove that the whole organization is secure. Framework mappings explain why a finding matters. They are not certificates, audit opinions or complete control-coverage claims.
Source:Cybersecurity Framework 2.0: frequently asked questions
Make remediation verifiable
For a real finding, retain the observation, explain the affected asset and specify how to verify a fix. Record changes separately from the original evidence. Broad cybercrime statistics provide context for defensive work, but they cannot establish a tool’s detection accuracy or prevented losses. No operational security results are claimed for this foundations release.
Source:2025 Internet Crime Report
Workflow
The intended evidence-to-remediation process
- 01 →
Authorize
Define the owner, asset and allowed scope.
- 02 →
Observe
Capture evidence and identify unknowns.
- 03 →
Explain
Connect the finding to a practical risk.
- 04 →
Verify
Check a remediation outcome against fresh evidence.
Intended product workflow. Real host checks are not delivered in Phase 0. NIST’s six functions are concurrent, not these four sequential steps.
Decision guide
Read assessment states accurately
| State or artifact | Meaning | What it cannot establish |
|---|---|---|
| Not assessed | No supported observation is available | A secure configuration |
| Finding | An observed condition with evidence | Every risk on the asset |
| Control mapping | A relationship to a framework outcome | Compliance certification |
| Audit log | A trace of captured events | Unobserved activity |
State definitions for interpreting assessments; no pass rates or detection benchmarks are published.
Metrics explained
- Assessment coverage
- Checks completed relative to clearly specified applicable checks.
- Evidence age
- Elapsed time since the observation supporting a finding.
- Severity
- An impact classification, distinct from proof of exploitation.
- Remediation verification
- A fresh check demonstrating the targeted condition has changed.
Questions, answered
Does Phase 0 perform real host checks?
No. The current work establishes the architecture and assessment contracts.
What does “Not assessed” mean?
The tool lacks a supported observation. It should not be treated as a pass.
Does mapping to NIST certify compliance?
No. A mapping explains relevance to a framework outcome; it is not certification.
Which assets belong in an assessment?
Only assets for which the operator has explicit authorization within the agreed scope.
References & further reading
- 01Cybersecurity Framework 2.0: frequently asked questions ↗
NIST
Defines the six concurrent functions and the framework’s intended use.
- 022025 Internet Crime Report ↗
FBI Internet Crime Complaint Center
Complaint-based cybercrime context. Reported losses are not total worldwide losses or evidence of Net Fortress effectiveness.