Reverse Engineering

For every claim, ask:

Which layer produced this evidence, and does it prove presence or execution?

Start with container and runtime identification, then load only the matching reference.

Default Posture