# Measured customer pilot

15 October 2026 • READY-TO-RUN PROTOCOL — CUSTOMER PILOT NOT STARTED

Objective: determine whether QILAHK delivers accurate, usable and commercially useful evidence and assessments under a defined scope. An offline synthetic run checks the protocol only; it cannot establish customer outcomes.

## Proposed cohort and scope

One authorized organization, 10 Windows test endpoints, one customer administrator, one qualified assessor, one separate decision reviewer, and three intended report recipients. Use a controlled test environment and include known good, failing, stale and incomplete cases. Select one business use case, such as a supplier review. Freeze the criteria version, device scope and comparison method before starting.

No customer or device access is assumed. Obtain written authorization, handling agreement, approved collection tool/version and publication preferences. Confirm the recovery plan before any separately authorized configuration change. No production security setting needs to be weakened to run the pilot; use synthetic failure fixtures or pre-existing test states where appropriate.

## Measurement definitions

| Measure | Definition | Proposed acceptance threshold |
|---|---|---|
| Collection accuracy | Correct field observations / independently checked mandatory field observations | At least 95%; zero false passes on mandatory failures |
| Coverage | Endpoints returning complete required fields / 10 in-scope endpoints | At least 9/10; incomplete endpoint never approved |
| Freshness | Accepted packages within agreed 24-hour observation window / accepted packages | 100% |
| Integrity | Deliberately altered test packages rejected / altered packages | 100% |
| Deployment effort | Administrator minutes from signed installer preparation to first valid package, per endpoint | Median at most 15 minutes; exceptions explained |
| Resource impact | CPU, memory and user disruption during collection versus precollection baseline | No user-blocking disruption; numeric resource limits agreed before run |
| Turnaround | Business days from acceptance of complete evidence to initial report | At most 10, if adopted and staffed |
| Remediation usefulness | Actions rated understandable, feasible and verifiable by customer administrator | At least 4/5 on each dimension |
| Verification usability | Recipients correctly identify valid, expired and revoked cases without assistance | All 3 recipients identify all 3 states correctly |
| Buyer acceptance | Recipient agrees report addresses stated review need | At least 2 of 3; record remaining evidence requests |
| Efficiency | Total person-hours for comparable review scope, before versus pilot | Report measured change; no assumed savings target |

Proposed thresholds are project choices, not industry benchmarks. A small cohort does not establish population-wide performance. Record numerator, denominator, exclusions, observation period and missingness; blanks mean not measured, never zero.

## Procedure

1. Day 0: confirm participants, authorization, data handling, tool release, scope, criteria and thresholds; gather baseline review effort and ground truth.
2. Days 1–2: deploy to test endpoints, record administrator effort and resource impact, collect packages and log failed collections.
3. Days 3–4: independently compare mandatory fields to trusted local observations; exercise stale, incomplete and tampered fixtures; record disagreements without deleting failures.
4. Days 5–6: assessor produces report and action plan; separate reviewer checks evidence and decision. Do not issue a production credential without the adopted production process.
5. Days 7–8: administrator evaluates and, if authorized, performs remediation; recollect evidence; verify closure against the same criteria.
6. Days 9–10: recipients evaluate report usefulness and sandbox status verification; record acceptance and remaining concerns.
7. Close: calculate metrics from actual records, hold a decision review, agree open actions, export customer artifacts and apply retention. Publish a case study only with written permission.

## Interview prompts

- What decision did you need this evidence to support?
- Which claims became easier or harder to verify?
- What was missing or confusing in the report?
- Could you implement and independently confirm each remediation step?
- Would your buyer accept this evidence; if not, what else is required?
- What would prevent deployment or renewal, and what price would be justified by measured value?

## Stop and escalation rules

Stop collection for unexpected sensitive-data capture, unauthorized devices, credential exposure or significant endpoint disruption. Preserve minimal diagnostic evidence through agreed channels and contact the designated pilot owner. Any false mandatory pass prevents a favorable pilot decision until investigated and retested. Never treat an unknown device as compliant to reach a target.

## Decision record template

Result: NOT RUN. Customer: not selected. Authorized owner: not supplied. Evidence location: not supplied. Actual measurements: none. Production issuance: none. Reviewer approval: none.

Go only when mandatory safety/integrity/accuracy checks pass, customer usefulness meets agreed thresholds and unresolved exceptions are explicitly accepted by an authorized owner. Otherwise revise or stop. Observed synthetic results belong in a separate test report and must not populate the customer results log.