In progress — Defend is still being built. Some Prove pages, menu names and actions described here may not be available yet in your build.
The Prove section of Defend is where you show clients what Defend is doing: security reports, compliance evidence from live telemetry, MITRE coverage, and audit exports.
Compliance programs live in CyberAssure. Framework programs, control mappings, assessments, uploaded evidence, policies, POA&M, audits, and gap analysis are in CyberAssure → Compliance. Defend doesn't manage frameworks or controls. It only shows how your live security signals line up with them.
Where to find it
Open Defend → Prove. The Prove pages are:
-
Security Overview (
/defend/prove/overview) -
Customer Reports (
/defend/prove/reports): build security reports for a client. -
Compliance Evidence (
/defend/prove/evidence): see below. -
MITRE Coverage (
/defend/prove/mitre) - Detection Health and Suppression Ledger
- Executive QBR, Audit Exports, and Scheduled Reports
Compliance Evidence
Compliance Evidence checks framework controls against live telemetry from your endpoints, detection rules, and configuration. Pick a framework tab: SOC 2, HIPAA, PCI, NIST CSF, or CIS. The page shows:
- How many of that framework's controls are mapped
- Evidence ready: controls that Defend telemetry can currently evidence
- Evidence gaps: controls with no evidence, because the signal behind them isn't present in this tenant
Each control shows a status (Evidence ready or No evidence). It isn't a button. Defend evaluates controls but doesn't collect or upload evidence files. A gap means Defend can't prove that control from this tenant yet. To track the control, attach manual evidence, or run an assessment, use CyberAssure.
If the page says it couldn't reach the compliance engine, posture data isn't available for that tenant yet. Mapped controls appear once it is.
FAQ
Is Defend's Compliance Evidence a compliance or audit product?
No. It's a view of what Defend's own security signals can evidence. Compliance programs and audits are run in CyberAssure.
Can I add a custom framework or edit control status in Defend?
No. Framework and control management is in CyberAssure → Compliance (Frameworks, Control Mappings, Assessments).