Quis custodiet ipsos custodes?

The first failure of every audit.

Once a year, a firm pays a great deal of money for someone to look at its perimeter. The auditor produces a PDF. The PDF goes in a folder. The folder is not opened again until next year. In the months between, the perimeter changes — a forgotten subdomain, a new certificate, an inherited misconfiguration — and the score that was earned at audit time becomes a kind of fossil. It described the past. It says nothing about the present.

This is the first failure: assessments treated as events, not as a standing condition. The world of the perimeter is continuous. The world of the assessment is discrete. The gap between them is where breaches live.

Custodis was built to close that gap.

Scores are earned, not assigned.

Every grade you see on Custodis is computed by a deterministic pipeline of checks. Each check has a written definition, a fixed penalty, and stored evidence. Same asset state, same score. Always. No model judgment, no quarterly recalibration, no auditor adjusting upward because the customer is unhappy with a B.

When your grade moves, you can trace the movement to the exact check, on the exact host, at the exact timestamp. The arithmetic is in the open. We will show you the penalty: severity × age × scope. We will name the finding by its ID. We will retain the raw observation.

We are not asking you to trust us. We are showing our work.

No evidence, no claim.

A finding without evidence is a rumour. Custodis stores the raw observation behind every penalty — the TLS handshake transcript, the DNS response, the HTTP header capture — and links it to the finding. If we cannot show what we saw, we do not claim it.

This is the second discipline of the order. The first is determinism. The second is provenance. Together they are the only honest answer to the question above the door.

Passive first. Active only with consent.

Discovery begins with public sources — certificate transparency logs, DNS, the things the internet already tells anyone who asks. We do not touch your servers until you have verified the domain and chosen to enable active checks. Even then: rate-limited, staged by sensitivity, and bounded by what you opted into.

A watchman who breaks down doors is no longer a watchman. He is a thief.