Origin — Why TrustSurface Exists
TrustSurface emerged from recurring patterns seen across incident response, delivery, and governance work.
Organisations would invest heavily in cybersecurity programs and still suffer trust failures that were:
- obvious to attackers
- visible to customers and partners
- difficult for leadership to govern
These failures were rarely exotic. They were the “boring basics” at the digital edge: spoofable email, brittle DNS, inconsistent identity boundaries, and unmanaged vendor integrations.
The recurring pattern
Across organisations and sectors, the same dynamics repeated.
Trust is experienced externally, but governed internally.
Teams measure internal controls; stakeholders experience external signals.Ownership is fragmented.
Domains become “marketing”, email becomes “IT”, vendors become “procurement”, identity becomes “security” — and nobody owns the joined-up trust outcome.Evidence is expensive.
When procurement, regulators, or boards ask for assurance, organisations scramble to assemble proof across disconnected teams and systems.Change causes regressions.
Trust posture decays through migrations, new vendors, and configuration drift. The failure is not a lack of intent — it is a lack of operating rhythm.
In practice, this is not just a security problem. It is a governance and accountability problem.
Why the term “Trust Surface”
The term is deliberate.
It reframes digital trust as something that happens at a surface — a boundary where systems and stakeholders meet.
It also reframes trust as something that can be:
- inventoried
- measured with observable signals
- governed through ownership and change control
- improved through a repeatable lifecycle
Why release it publicly
The trust signal gap is widespread, and the language to describe it is inconsistent.
TrustSurface is published as a public-good vocabulary to make trust posture:
- discussable across technical and governance audiences
- measurable through evidence, not assurance
- operable as a cadence, not a one-off hardening project
TrustSurface is intentionally not a product. Tools and templates can vary. The shared model and vocabulary are the asset.
What is included (and what is not)
Included:
- the core framework documents and diagram
- the glossary and the operating rhythm
- guidance for adoption and comparative positioning
Excluded (unless explicitly licensed):
- proprietary assessment instruments
- implementation templates and delivery methods
Authorship
TrustSurface is authored and maintained by Bryan Chetcuti and is open to improvement via consultation and contributions.