Double Entry Accounting for Security

The talk asks whether double-entry accounting, the bookkeeping method that underpins modern finance, can help security programs notice when their picture of the environment is incomplete. The speaker argues that a single source of truth is a myth and splits the idea of truth into three parts borrowed from sworn testimony. Checking whether a claim is false is easy; recognizing that something is missing is far harder.

The core model divides security data into two ledgers that stay separate but must reconcile. One ledger is structural awareness, the inventory and state of assets such as a CMDB. The other is situational awareness, the events and logs that show what happened. When a state change appears with no matching log entry, that mismatch reveals a visibility gap. The team can then investigate or accept the gap, much as a small petty cash fund may not justify precise tracking. Event-based systems struggle to rebuild state and polling misses transient events, so the ledgers should check each other rather than replace one another.

For practitioners, the message is to identify places where two independent records already exist and compare them, and to set realistic tolerances instead of demanding zero errors, as finance does with small variances. The Q&A extended the idea to forecasting against license entitlements and seasonal patterns, and to materiality, which the speaker said the community has not yet defined for cyber.