Glossary
Attestation
A formal statement issued by an identifiable party asserting, on its own responsibility, that something has been checked and over what scope.
- Attestation letter
An attestation is not the same thing as evidence. Evidence shows the fact; an attestation is someone putting their name behind a conclusion about that fact. Its value depends entirely on three things: who signs it, how independent they are from what is attested, and what scope it declares.
Commercially it is used a great deal to avoid handing over the full report: instead of sharing a pentest containing internal paths and unfixed vulnerabilities, you supply a letter confirming that it was performed, on what dates, over what scope and with what overall result. That is a reasonable solution as long as the letter bounds the scope precisely.
An attestation saying “the platform has been audited and is secure” adds nothing. One saying “between 4 and 15 March 2026 components X and Y were audited; high-severity findings were closed on 2 April and verified by retest” is usable.