Your security tools tell you what they observe. Your delivery organisation tells you what it is doing. EKSTROPI tells you what the accumulated evidence now lets leadership treat as true about the transformation. One governed position, current to the latest admitted evidence, that a security leader can carry into the board and defend.
The rollout is progressing. 82% of privileged accounts are enrolled in the control.
Independent evidence that the control is enforced on the payments platform is unavailable.
The current admitted evidence does not demonstrate that privileged access is under governed control.
A security transformation produces two kinds of confident number and one thing that actually matters in the room.
Your PAM, your identity platform, your SIEM each report enrolment, events and coverage in their own language. Each is true, and none of them is a position.
The transformation reports its own progress: controls deployed, phases closed, milestones met. A plan reports how far it has run, not what it has made true.
EKSTROPI resolves both against one commitment and holds the result to evidence. What is proven stands. What is only asserted stays visibly unproven.
Observation is not authority. A control that is deployed is not yet a control that is proven.
Start at the headline a steering pack would show, and descend into the same governed reality one admitted fact at a time.
Six planes of this programme resolve against that single commitment into one current position. Each speaks its own language. EKSTROPI holds them to one reality.
Orphaned and shadow admin accounts are not yet counted against the estate.
Coverage is reported. Enforcement is not the same as coverage.
Independent evidence that the control is enforced on the payments platform is unavailable.
Break-glass and service-account paths currently bypass the control.
Vendor privileged routes are attested, not evidenced.
Audit expects demonstrated closure, not reported completion.
Your programme keeps its own control structure. EKSTROPI governs the position across it.
The estate is read again at every observation. What changed is separated from what merely happened.
Exposure fell as the rollout advanced, then stopped falling, while deployment carried on.
Privileged access management was advancing on plan. On the evidence admitted then, the programme was reasonably read as closing the gap ahead of the deadline.
Deployment reached 82%, but a supplier attestation admitted this observation added a privileged route, and runtime enforcement on the crown-jewel system remains unproven. More was deployed. Less is settled.
Better knowledge changes today's position. It does not rewrite what the last review was entitled to conclude. What the programme knew at OBS5 remains reconstructable exactly as it was known then.
Parallax shows not just what is unproven, but what is standing on it.
Deployed, and not independently evidenced. On its own, one line in a control register.
The payments platform is operating without proven enforcement of the control that is meant to protect it.
The regulatory closure due in 60 days expects demonstrated closure, and this is the demonstration that is missing.
Three supplier privileged routes remain in scope of exactly the control that cannot yet be proven.
The sign-off leadership is being asked to give rests on the one plane that is not yet evidenced.
The finding did not get larger. Its consequence did, once you could see what it touches.
The position is not a slide. A security leader can question it, and it answers from the same governed reality every time.
Not demonstrably. Privileged access management is deployed to 82% of accounts, and that coverage is evidenced. Enforcement on the crown-jewel system is not. 23 standing exceptions currently bypass the control, and 3 suppliers retain privileged access on attestation alone.
Everything above resolves to one sealed, one-page position: the Project Indigo Executive Decision Brief. Issued from the demonstration estate, verifiable in the recipient's hand.
The delivery evidence you already produce becomes an executive position your customer can carry into the board, without you changing how you work.