Avoid absolute words such as all, every, always, never, fully, guaranteed and zero in security answers. One counterexample breaks the claim, and a reviewer only needs one. Replace them with bounded wording that states scope, mechanism and date, so the answer stays true after the next change.
Why absolutes fail
Security controls operate across many systems and many people. The chance that something is true of all of them, at all times, is small. An absolute also changes the burden: you must now prove a universal. A bounded statement only needs the evidence for what it names.
Words and bounded replacements
| Avoid | Why it fails | Use instead |
|---|---|---|
| All systems | One forgotten system breaks it | Production systems in the listed scope |
| Always | One exception breaks it | By default, enforced by a named setting |
| Never | One lapse breaks it | Policy prohibits, and a control detects |
| Fully encrypted | Scope unclear | Data at rest in the named stores and in transit on named paths |
| Zero vulnerabilities | Depends on scan and date | No known critical findings open as of a stated date, by a named method |
| Guaranteed | Sounds contractual | We target, we monitor, we track |
| Secure | Meaningless alone | Say which control and which risk |
| 100 percent | Rarely measured | State the measured share and the date |
How to tighten an answer
- Underline every absolute in your draft.
- For each, find the scope: which systems, which people, which period.
- Rewrite with the scope named, or the word removed.
- Add a date where the claim could change.
- Cite the evidence next to the claim.
Example
Before: "All employees complete security training and all code is reviewed."
After: "Employees complete security training at onboarding and annually, tracked in the training system. Changes to production code require an approved review, enforced by branch protection on the listed repositories."
The second version is longer but defensible, and each half points to a record.
Numbers and dates
Percentages and counts are claims too. Use them only when you can reproduce the figure from a system, and say the date. Do not round up. If a figure came from a point in time, say so, since a number from last quarter should not be presented as current.
Teams that write answers
Add an absolute word search to your review checklist. Run it over the answer library once, and over each new questionnaire before it goes out. Sales and customer success should get the same list. It is a five minute check that prevents many awkward conversations.
Exceptions
Absolutes are fine when a system makes them true, for example "the setting cannot be disabled by users", if you have verified that. Even then, name the system and record the check.
Where Safeguard fits
Safeguard's compliance and evidence automation keeps dated records behind each statement, so bounded wording is easy to support, and the free scan at https://gold.safeguard.sh/scan gives a dated result you can cite instead of a universal.
Quick check
Is it ever safe to say fully compliant?
Seldom. Name the framework, the scope, the method and the date instead, and do not use the word where only a mapping exists.
Do numbers count as absolutes?
They are claims that need a source and a date. Do not round up or reuse old figures.
Last reviewed: 19 October 2026.
