Compliance verification testing using negative validation

A computing system for implementing compliance testing to evaluate controls used to protect assets of a target system, the system comprising one or more processing devices and one or more non-transitory machine-readable storage devices storing instructions that are executable by the one or more processing devices to cause performance of operations comprising:

• generating a respective first score for each control based on a plurality of compliance tests that are performed to detect each of the controls at the target system;
• generating a compliance model that integrates machine-learning algorithms to:
• i) classify inputs corresponding to a compliance test, and
• ii) enable predictive analytics of the compliance model using the classified inputs;
• deriving, by the compliance model, a negative compliance test for each of the plurality of compliance tests by applying the predictive analytics to a data set comprising the respective first score for each of the controls;
• for each control detected at the target system:
• performing a negative compliance test that corresponds to a compliance test performed to detect the control;
• generating a second score for the negative compliance test that is performed;
• and
• based on a comparison of a first score for the control and the second score, generating an assurance score that characterizes effectiveness of the control at protecting an asset of the target system.

A non-transitory machine-readable storage device storing instructions for implementing compliance testing to evaluate controls used to protect assets of a target system, the instructions being executable by a processing device to cause performance of operations comprising:

• generating a respective first score for each control based on a plurality of compliance tests that are performed to detect each of the controls at the target system;
• generating a compliance model that integrates machine-learning algorithms to:
• i) classify inputs corresponding to a compliance test, and
• ii) enable predictive analytics of the compliance model using the classified inputs;
• deriving, by the compliance model, a negative compliance test for each of the plurality of compliance tests by applying the predictive analytics to a data set comprising the respective first score for each of the controls;
• for each control detected at the target system:
• performing a negative compliance test that corresponds to a compliance test performed to detect the control;
• generating a second score for the negative compliance test that is performed;
• and
• based on a comparison of a first score for the control and the second score, generating an assurance score that characterizes effectiveness of the control at protecting an asset of the target system.