legible-sec

legible-sec

One of the hardest parts of security is explaining a finding to the people who have to act on it, and most of them are not technical. Legible studies how that second telling is done, by collecting pairs of the same thing written twice, once for the engineers and once for whoever has to decide. Out of those pairs comes a rubric: a written list of what a retelling has to carry over from its source and what it owes the person reading it, where every item says how it can be checked and how far that check can be trusted. Three instruments run on it. A reviewer that checks a draft against the finding it came from. A benchmark that measures how much a language model drops when it writes the summary itself. A search for how the field has already explained something like it.

ongoing research open source · coming soon

In 2023 a China-based group known as Storm-0558 broke into email accounts at the US State and Commerce Departments through Microsoft’s cloud. The review board’s report explains the cause twice, once for engineers and once for leadership.

written for engineerssection 1.2

The flaw was caused by Microsoft’s efforts to address customer requests for a common OpenID Connect (OIDC) endpoint service that listed active signing keys for both enterprise and consumer identity systems. However, Microsoft had not adequately updated the software development kits (SDKs), which Microsoft and its partners both used, to differentiate between the consumer MSA and the enterprise signing keys within the common endpoint. As a result, this allowed successful authentication to the Entra system for certain applications, such as mail, regardless of which key was used.

retold for leadershipexecutive summary

Signing keys, used for secure authentication into remote systems, are the cryptographic equivalent of crown jewels for any cloud service provider. [...] In fact, when combined with another flaw in Microsoft’s authentication system, the key permitted Storm-0558 to gain full access to essentially any Exchange Online account anywhere in the world.

01The problem

Security work ends in a retelling. A finding written for engineers has to be explained again to a board, a regulator or a customer, and when that retelling fails nobody notices, because the reader only ever sees the retelling.

What can get lost

  • A number leaves and the sentence closes over the gap.47 several servers
  • A number survives but loses its frame.MFA at 92% against a 98% target and falling
  • The severity moves. A Critical is retold like routine maintenance, or a Low is retold as urgent.critical routine · low urgent
  • The condition that bounded the risk is dropped, so a limited risk reads as unlimited.exploitable only with local access
  • The status drifts. A weakness still open is retold as fixed, or a possible attack as one that happened.one remained open corrected
  • The clock disappears, what is known now and when the next update comes.as of 14:00, next update at 18:00

What can fail to land

  • Every fact survives in the engineer’s vocabulary, so the reader cannot tell what happened.“exploited a token validation issue”
  • It never answers the reader’s questions, what is at risk, how bad it is, what they have to decide.what is at risk?how bad?what do I decide?
  • It hedges until the reader cannot tell whether they were affected.“your information may have been impacted”
  • It ends without an ask, so nobody knows what happens next or who has to act.next step · none

The audience matters. None of these is necessarily wrong. The audience decides what a retelling has to carry, so the same omission can be right for one reader and a failure for another.

02The corpus

Legible finds a technical finding, and the version of it written for an audience that will not read the technical text. Both halves are quoted exactly as they were published.

Some of the shapes a pair can take

One document

Both halves inside the same report: the detailed version, and the retelling written for whoever commissioned it. The most common shape.

Two documents, one event

Two separate publications about the same incident, written for different readers and released at different times.

Report and message

A written record on one side, and the message somebody sent about it on the other. A handover, an email, a note upward.

Concept and analogy

A technical concept, and the plain-language image somebody else wrote to explain it. Different authors, no shared document.

3.7k+aligned pairs so far
2,059source documents, 12 kinds
179organizations
2011–26report years, where the year is known
Who wrote them · pairs per organization
Trail of Bits1,237
CISA836
Cure53368
GAO198
OSTIF114
GitHub advisories98
FTC94
172 others782
What else it holds · beyond the pairs
926ways the field has explained a concept in plain language, gathered from public writing
165of those are analogies, each one kept with the concept it was written for
15families of source, from consultancy reports and government audits to advisories, postmortems and regulatory filings
sources

All of it comes from writing already published in the open. Each pair keeps its document, link and licence.

no generated text

A model was used to point at passages. The code kept a passage only if it was really in the document.

contributions

The corpus is not a finished set. Once it is open, other people can add to it.

03The rubric

A shared standard for the reviewer and the benchmark.

The rubric defines what a security explanation needs to get right. It asks whether the text preserves the finding’s meaning and whether it gives its intended reader the information they need. Those are different questions, so the answers stay separate.

Its eight dimensions draw on two sources: what professionals actually wrote in the corpus, and 237 industry documents about how security should be communicated. The priorities change with the reader and the situation.

Same finding. Different reader.A board briefing needs the consequence, the current risk, and what needs a decision. An engineering ticket needs the affected component and a fix the engineer can verify.

Faithful can still be unhelpful.Both texts must preserve the facts that matter. But copying the same technical detail into both does not make them equally useful. The rubric assesses each against its own reader’s needs.

FFidelity

Did it keep faith with the source? Numbers, severity, scope, caveats, what is still unknown.

UDecision utility

Is it any use to the reader? Their questions answered, their language, something they can act on.

Select a dimension to see its checks. These describe the full instrument; the preview below covers only part of the rubric.

How the rubric can be measured
L0rules

Check explicit details in the text.

show the wording behind each finding
L1semantic checks

Estimate whether a claim is supported by its source.

report confidence and the passage assessed
L2model judgment

Offer an opinion on what rules cannot settle.

quotes must match the source; opinions advise
Hhuman review

Leave judgment with a person when it cannot be automated.

unexamined does not mean correct

The rubric is still being calibrated. Its eight dimensions define the intended assessment; an automated check does not reach every dimension. The reviewer and benchmark must state what they examined and what remains for a person to judge.

04The reviewer

Keep the meaning. Write for the reader.

Put a finding beside the explanation you are writing. The reviewer points out what changed, shows the source behind each concern, and helps you decide what to revise. Try the worked example, or paste your own two texts.

Interactive preview · example feedback

Source finding

Illustrative finding · written for this demo

Your draft

Edit the explanation. Follow the evidence.

05The benchmark

Lost in Translation?

How well do language models preserve a security finding when they explain it to someone else? Each model receives the same finding and the same intended reader. The briefing it writes is then assessed against the Legible rubric.

STUDY DESIGN · BENCHMARKING LLM FIDELITY IN EXECUTIVE SECURITY BRIEFS

A shared finding, separate briefings, one rubric A real finding and a named reader are given to each of three illustrative model families: OpenAI, Claude, and Gemini. Each writes a separate briefing. All briefings, together with the original finding and reader context, are assessed against the Legible rubric. Fidelity and decision utility remain separate. 01 / SAME FINDING & READER 02 / EACH MODEL WRITES 03 / ASSESSMENT A real findingfrom the corpus For the boardone named reader OpenAI · illustrative model family Claude · illustrative model family Gemini · illustrative model family Their briefings Legible rubric8 dimensions FidelityDecision utility Read the rubric ↗ assessed against the source and reader A finding and reader go to OpenAI, Claude, and Gemini models. Separate briefings are assessed against the source and reader using the Legible rubric. 01 / SAME FINDING & READER For the board A real findingone named reader 02 / EACH MODEL WRITES OpenAI Claude Gemini Their briefings 03 / ASSESSMENT Legible rubric8 dimensions · read the rubric ↗FidelityDecision utility against the source and reader
Figure 1. A shared finding, separate briefings, one rubric. The source and the intended reader remain part of the assessment. Fidelity and decision utility are reported separately. Logos illustrate model families; they do not indicate completed runs or a finalized model selection.
DESIGNED · NOT YET RUN

The rubric defines what to assess. The research is determining how reliably each part can be measured. Results will identify the checks used, their measured ability to catch errors, and what still requires judgment.

06Retrieval

See how others already explained it.

Paste a finding and get back real pairs from the corpus: findings like yours, and the summaries professionals actually wrote from them. Ask for a concept instead and it returns the definitions, plain-language explanations and analogies the field has already used for it. It is precedent, not a set of approved answers, and every result shows exactly what matched and where it came from.

retrieval · a sample of 12 pairs

A sample of 12 public pairs. The full library searches every shareable pair in the corpus, ranking exact identifiers first and then shared terms.

07What comes next

Ongoing research, open source soon.

Legible is still being built. When it is ready, the corpus, the rubric and the three instruments will be released as an open-source project, so any security team can check its retellings, test the models it relies on, and learn from how the field already writes.

01corpus

More and better pairs

A larger corpus from more kinds of source, every pair traceable to the document it came from and shared under its own license.

02rubric

A calibrated rubric

Weights checked by hand against real pairs, so what fails a text is grounded in how the field actually writes.

03instruments

Tools you can run

The reviewer, the benchmark and the search, open and running in your browser or on your own machine, so findings never have to leave it.