Finding
A dated incident or evaluation establishes the trigger and its scope.
Look for: incident report, red-team finding, review.PolBenchby Syntony Public evidence pilot v0.4 / OCT 2026
Governance response data
Governance changes
after incidents.
PolBench records changes to organizational policy and oversight after security incidents and AI evaluations. Select a company to review its response and sources.
PolBench
evidence registerPOLBENCH
evidence registerPOLBENCH
Public records of organizational responses Explore a company ↗
Organizations in this releaseLogos identify the organizations discussed; inclusion does not imply endorsement.
01 / ORGANIZATION RECORDSSearch through 20 October 2026 · v0.4
Organization records.
Expand a row to see its score calculation and source material.
The records cover specific responses, rather than each company as a whole.
—response episodes
in the pilot
in the pilot
Scores measure evidence completeness. Each supported checkpoint adds 20 points, whether documented or self-reported. A score of 100 means all five have evidence; it does not establish that the response worked. These are historical episodes, with different source periods.
Scoring method ↗Expand any row for the evidence behind its score.
| Compare | Organization / response episode | Finding | Decision | Ownership | Implementation evidence | Validation evidence | Score ⓘ | Open case |
|---|
No episodes match your search.
The evidence could not load. Open the source dataset or refresh this page.
DocumentedSelf-reportedPlannedNot established
Download dataset (JSON) ↓Scores use the same five checkpoints and equal points for documented and self-reported evidence. A decision can precede implementation; a test can find failures. Missing evidence adds no points and does not establish inaction. Sorting by score compares the completeness of these records, not the organizations’ governance.
Research questionOrganizational
Organizational
responses to incidents.
PolBench asks whether organizations change their policies or decision processes after a security incident or adverse evaluation.
The records cover changes such as release requirements, access policies, management responsibilities and review procedures. A technical repair alone does not establish a change in governance.
Read the inclusion criteria02 / THE METHODOLOGYOpen protocol · Version 0.4
Scoring and
coding rules.
Each response episode consists of an incident or finding, a specific organizational response, and the sources used to assess it.
01 / OBSERVEFinding
A source identifies the incident or evaluation and the concern it raised.
Decision
A named commitment, proposal, authorization, or activated rule is explicitly linked to the trigger.
Look for: revised rule, release gate, formal response.Ownership
A source names the role, team or governing body responsible for the response.
Look for: named responsible role, assigned team, governing body.Implementation
A source reports or documents the changed process or control in use.
Look for: rollout record, enforced gate, operating artifact.Validation
A source describes a completed assessment of the response and gives its method and result. The record also identifies what was tested and when.
Look for: retest, audit, scoped follow-up evidence.Score calculation
20 × supported checkpoints0–100
Each checkpoint labelled Documented or Self-reported contributes 20 points. Planned and Not established contribute zero. This is the five-category evidence count expressed on a 0–100 scale. It adds no new information or statistical precision.
A score of 80 means four categories have evidence; 100 means all five do. Neither establishes good governance, a successful response, or an independent assessment. Source labels remain visible because identical scores can rest on different evidence.
The scale has no pass mark or calibrated performance bands. Use the row details to compare scope and provenance. Different disclosure practices and source periods limit comparisons.
How to read the labels
- Documented
- Operative policy text, a legal instrument, or an external record supports the narrow claim. An organization’s announcement alone is labelled Self-reported.
- Self-reported
- The organization reports the checkpoint. An assessment described only by that organization retains this label.
- Planned
- The relevant assignment, operation, or test is promised or required, but not established as completed. An explicit commitment may still establish the separate Decision checkpoint.
- Not established
- The cited sources do not show whether this checkpoint occurred. The organization may have acted without a public record.
What this pilot can establish +
PolBench is a descriptive collection of 14 selected episodes: 13 security or privacy responses and one AI evaluation response. It maps source-supported institutional responses. It does not estimate how often organizations act, compare industries, or identify causal effects.
Cases were selected partly because a response was publicly visible. That selection, unequal disclosure, different source dates, and the single evaluation case prevent population estimates and cohort comparisons. Temporary resource decisions and existing-policy activations are explicitly distinguished from new governance rules.
Source dates, attribution, and missing evidence +
The source cutoff is the latest dated source record or stated update. Report dates and unknown public-release dates are identified in the source notes. Sources were searched through October 20, 2026. The latest source date is shown separately for each record. Report dates may differ from publication dates, and page archives were not reconstructed.
A cited source must link the response to the finding. An organization's explanation supplies that link, but cannot by itself establish causation. A checkpoint stays unknown when the sources cannot support it. Several publications may rely on the same account, so the number of sources does not measure independent corroboration.
Research status and validation requirements +
Version 0.4 remains a provisional desk review. Source rechecking added a direct external assessment to the Meta case. Independent duplicate coding, expert content validation, and study-level outcome validation remain incomplete. Software tests verify the calculations and data structure.
A broader study requires a trigger-based sampling frame chosen before observing responses, comparable follow-up periods, independent coding before adjudication, an explicit missing-evidence analysis, and separate tests of implementation, effectiveness, and durability.
Scientific foundations and complete codebook +
The framework draws on NIST's distinction between governance, response, and improvement; process-tracing principles for linking events and decisions; and established guidance on measurement and coding reliability. These are foundations for the design, not validation or endorsement of PolBench.
Read the complete methodology, coding rules, references, and release notes ↗
Submit a correctionCorrections
Corrections
and new sources.
Send a source URL and identify the record or claim it concerns. Suggestions for additional cases are welcome.
Submit evidence or a correction
Corrections are reviewed before publication.
Please send public source links only.