Evidence Half-Life

What Evidence Half-Life Means

Evidence Half-Life describes how quickly security evidence stops being trustworthy enough for decision-making. Freshness matters because a log, scan, approval, or attestation can be correct when collected and misleading shortly after if systems, identities, access states, or controls have changed.

The idea is especially important in IAM, NHI governance, and incident response, where evidence is often used to justify access decisions, prove control operation, or reconstruct what happened. The value of the evidence is not just whether it exists, but whether it still reflects the current environment.

Why Freshness Determines Trust

Security teams often treat evidence as if it were a permanent fact. In practice, evidence is a snapshot. A successful review today may already be stale tomorrow if a service account is rotated, an integration is changed, a privilege is added, or a system drifts out of baseline.

This is why evidence half-life is not only about time passed, but about change rate. Fast-moving environments, high-privilege systems, and delegated access paths all shorten the useful life of evidence because the underlying reality can diverge quickly from the record.

Where Evidence Ages Fastest

Evidence decays fastest when it is tied to states that change often: credentials, sessions, tokens, approvals, runtime permissions, configuration drift, and ephemeral infrastructure. A point-in-time export may look authoritative while missing changes that happened immediately after collection.

That creates a common governance trap. Teams may rely on a clean scan, an old approval trail, or an archived log set and assume the conclusion still holds. The older the evidence, the more likely it is to describe a previous security state rather than the current one.

How to Interpret Old Evidence

Old evidence is not useless, but it should be treated as historical context rather than current proof unless the question being answered is also historical. For current assurance, the reader should ask whether the evidence is still within the operational window in which the environment is stable enough for the finding to remain valid.

Evidence half-life is therefore a judgment about confidence. Short half-life evidence supports near-term operational decisions; long-lived evidence is better for trend analysis, retrospective investigations, or control history. The critical distinction is whether the evidence still matches the present control state.

Risk and Threat Considerations

Stale evidence can create false confidence, especially when it is used to approve access, close an incident, or certify compliance. Attackers benefit from that gap because evidence that is merely old can conceal privilege changes, lingering sessions, credential abuse, or recovery gaps.

Failure mechanism: The control or review process relies on evidence that no longer matches the live state, so a material change slips through without revalidation.

Impact: Organisations can misjudge exposure, miss active compromise, retain excessive access, or sign off on controls that are no longer effective.

Practitioner Guidance

Why practitioners should care: Evidence half-life should shape how long a team is willing to trust logs, scans, approvals, and attestations for a given decision. The shorter the half-life, the more often evidence must be refreshed before it can support access, assurance, or incident conclusions.

Common misunderstanding: Teams often assume that a documented control outcome remains valid until the next scheduled review. In reality, the evidence may expire operationally long before the review date if the underlying environment changes quickly.

Practitioner takeaway: Treat evidence as time-sensitive proof, not a permanent record, and match its reuse to the volatility of the system and decision it is supposed to support.

Related resources from NHI Mgmt Group

• Why does long remediation half-life increase security risk?
• How should security teams reduce vulnerability remediation half-life without adding more staff?
• Exception Half-Life
• Secret Exposure Half-Life