SOC Analysis · Cohort 1 finalist
Elizabeth Nyimenka Benson
Built Silent Success — when a security tool reports success and produces nothing
Technical highlights
- I catalogued 28 real cases, 20 from earlier stages of this work, 8 created by accident while building it, and sorted them by what a check could notice, not by cause: six classes.
In the finalist's own words, from their project submission.
SOC Analysis project
Silent Success — when a security tool reports success and produces nothing
An unplugged smoke alarm looks exactly like a smoke alarm with nothing to report. Both are quiet. Only one is working. Security tools fail the same way: one can run, finish and report success having done none of the work — no rules loaded, no traffic inspected. Nothing crashes, and a tool that found no attacks looks exactly like one that never looked. That costs the analyst who reports no attack, the auditor who accepts the logs as evidence, and the organization that learns months later nothing was watching. I catalogued 28 real cases, 20 from earlier stages of this work, 8 created by accident while building it, and sorted them by what a check could notice, not by cause: six classes. Four have guards that assert the work happened and never turn "cannot tell" into a pass. One is catalogued without a guard. The sixth needs none: its countermeasure is a discipline — every guard branch is broken to prove a test catches it. What changed: anyone can clone this and watch a real tool report success while inspecting nothing, then watch the guard catch it. Of the eight failures I introduced, six were in the code that verifies, not the thing verified. Nobody verifies the verifier.
