---
id: agent-brief/model-security
artifact_id: model/security
source_path: models/security/InfoTechCanonSecurityModel.md
source_kind: model
generated: true
---

<!-- GENERATED by info_tech_canon; do not edit by hand. -->

# Agent Brief: InfoTechCanon Security Model

- Artifact ID: `model/security`
- Kind: `model`
- Canonical path: `models/security/InfoTechCanonSecurityModel.md`
- Full source: `models/security/InfoTechCanonSecurityModel.md`
- Summary: Domain model used by canon profiles and standards: InfoTechCanon Security Model.

## Retrieval Hints

Imports and anchors:
- `kernel/itc-core`
- `model/access-control`
- `model/evidence`

## Owned Concepts

- `AttackImpact`
- `AttackPath`
- `AttackPattern`
- `AttackPrecondition`
- `AttackStep`
- `AttackTechnique`
- `BlastRadius`
- `ChokePoint`
- `CompensatingMeasure`
- `Containment`
- `DataSecurityFinding`
- `Detection`
- `DetectionCoverage`
- `DetectionRule`
- `Eradication`
- `Exploit`
- `ExploitLikelihood`
- `Exploitability`
- `Exposure`
- `ExposureFinding`
- `HardeningMeasure`
- `IdentityFinding`
- `InfoTechCanon Security Model`
- `Investigation`
- `LessonLearned`
- `Misconfiguration`
- `MisconfigurationFinding`
- `Mitigation`
- `PenTestFinding`
- `ProtectedAssetReference`
- `Recovery`
- `SecurityAssessment`
- `SecurityBoundary`
- `SecurityDomain`
- `SecurityEntity`
- `SecurityEvidence`
- `SecurityFinding`
- `SecurityIncident`
- `SecurityMeasure`
- `SecurityPosture`
- `SecurityPostureScore`
- `SecurityReview`
- `SecuritySignal`
- `Severity`
- `SupplyChainFinding`
- `Tactic`
- `Threat`
- `ThreatActor`
- `ThreatEvent`
- `Vulnerability`
- `VulnerabilityFinding`
- `Weakness`

## Related Distinctions

- **Policy vs Control vs Evidence**: Governance owns policy and control; ITC-EVID owns the distinct evidence assertion and its addressable source. Evidence supports a stated interest without guaranteeing truth.