Security: scope boundaries and one fact said four ways

Same zero-day, CVE-2024-3400. Same nine dated public sources. One clean run: 72 beliefs, no failed extraction pass. The strongest of the three recipes. Two questions show why, and one shows where it still repeats itself.

Scope is a belief

We manage a fleet of unpatched firewalls through the vendor's central console. Are we exposed, and does the console change that?

Exposed. The console itself is outside the vulnerability. The firewalls it manages are not. Two scope boundaries from different advisories, kept as separate beliefs, so "the console is fine" never turns into "the fleet is fine".

Scope boundaries carry most of the weight in security, and most of the ambiguity. Which versions, which configurations, which component. A summary blurs them. The belief state keeps each one with its own source and date.

Two actors, not one

Is this ransomware? The sources describe two activities. A targeted espionage actor exploited the flaw before disclosure. Opportunistic mass scanning followed. Each is its own scoped belief. Merge them and the threat model is wrong in both directions.

The console is out of scope. The fleet behind it is not. Two beliefs, never one.

One fact, said four ways

Does an attacker need valid credentials? No. The CVE record says "unauthenticated attacker". The threat brief says "no authentication required". Same fact, different words.

It is answerable. It is also extracted four times, as four near-identical beliefs instead of one. Correct, but not canonical. Duplicates inflate apparent support: four beliefs look like four confirmations. For continual reasoning under uncertainty, repetition must not count as evidence. Merging restatements across sources is open work, reported here rather than hidden.

What held

All four traps built into the recipe survived as distinct, correctly opposed or scoped beliefs: the telemetry walk-back, the console exclusion, espionage against mass scanning, and patching against backdoor removal.