A security report or certificate works as a signal. According to Spence's signalling theory, a signal is credible only when it costs low quality senders more than high quality ones. If it is cheap for anyone to get, it tells the buyer nothing, so look at how hard it was to earn.
The theory in short
Signalling economics describes a sender who uses an observable action to reveal a hidden quality to a receiver. The classic example is education. Suppose two groups of workers differ in productivity and an employer cannot tell them apart. If getting a degree is costlier for the less productive group, the more productive group can separate itself by getting one.
The key requirement is that cost differs by type. If everyone faces the same cost, the signal cannot sort them. Costs include time and effort, not just fees.
Wikipedia also notes a striking point from Spence's model: a credential can have value as a sorting device even when it adds nothing to productivity.
Separating and pooling
In a separating outcome, strong and weak senders choose different actions, so the buyer can tell them apart. In a pooling outcome, they take the same action, and the signal reveals nothing.
For security, a good signal produces separation. A weak one produces pooling, where every vendor holds the same badge.
Applying it to security evidence
Ask of any claim: how much harder is this for a weak vendor than for a strong one?
- Low differential cost. A badge on a website, a self written questionnaire answer or a policy document with no tests behind it. A weak vendor can produce these almost as easily.
- Higher differential cost. A report from an independent assessor covering a period of real operation, a published vulnerability disclosure process with a track record of fixes, or a trial the buyer can run on its own code.
The scheme matters too. Anderson and Moore describe how evaluation schemes can suffer when vendors pick lenient evaluators, which weakens the signal. See the lemons problem in security products.
What buyers should do
- Read the scope and dates, not only the title.
- Prefer evidence that took sustained operation to produce.
- Test claims against your own data when you can.
- Weight several independent signals more than one loud one.
See also what security reviewers check first on your trust page.
What sellers should do
Make weak claims unnecessary. Publish methods, share limits openly and let buyers test. A seller who invites a test sends a signal that is costly for a weak product to send.
Quick check
What makes a signal credible?
It must cost less for strong senders than for weak ones, so weak senders cannot copy it cheaply.
Is a badge on a website a strong signal?
Usually not, unless getting it required hard to fake work that you can verify.
Sources
Last reviewed: 19 October 2026.
