Skip to main content
CMDashCybersecurity Maturity Dashboard
DocsFeature guidesSkeptic

Skeptic

What it is

The Skeptic (/skeptic) lists the places where your own records contradict each other. It reads records you already have and never writes one. Four rules run today:

  • Policy cadence contradicted: a policy in force says an activity happens on a schedule (access reviews "quarterly", for example) but the completed records show the last one was further back than that, or that none was ever completed.
  • Policy still the template: a policy in force is still the unedited text of the template it was created from.
  • Claim without a current receipt: a practice is recorded as implemented, a measured claim covers it, and no current signed receipt backs that claim.
  • Evidence past its validity window: evidence attached to a control has outlived the validity period your organization set.

Each finding names the record it is about, lists as chips every record that made the rule fire, and links to the page where it is fixed.

When to use it

Before an audit, a signature or a customer questionnaire: it is the list of things a skeptical reader would find by comparing your documents with your records.

Before you start

  • Tier: the findings are included on every tier, Free and up.
  • Role: any member can read them. Asking for an AI explanation is Owner or Admin, because it uses the organization's AI budget.
  • AI explanations need the AI drafting entitlement (Starter and above). Below it, the button answers with a message and the fix link still works.

How to

Read and fix a finding

  1. Open Skeptic in the sidebar (Proof group).
  2. Optionally narrow the list with the Rule selector; the choice is kept in the address bar.
  3. Use Go to the fix. When the records stop contradicting each other, the finding disappears on the next check.

Ask for an explanation

Select Explain this finding. You get a short reading and a suggested fix. The text is labelled AI-drafted. The AI is given only the finding's rule, record ids, counts and dates; it never sees policy text, evidence or receipt contents. Without an AI key configured, you get fixed guidance for the rule instead, and no AI budget is used.

Not the same as the Skeptic add-on

CMDash's AI add-on (the SKU previously shown as "AI Assistant") is now named The Skeptic everywhere it is displayed. Only the display name changed; the entitlement, routes and billing identifiers are the same. The findings on this page are not that add-on and are included on every tier. The Explain this finding button is gated by the AI drafting entitlement (Starter and above), not by the add-on.

Common questions

Can I dismiss a finding? No. A finding goes away only when the records agree.

Can I attach an explanation as evidence? No. An AI-drafted explanation is advice. It cannot be attached to a control as evidence.

The list says it was capped. The check reads a bounded number of records. A capped list is a lower bound, never a clean bill.

This page is the product manual, published from the repository at docs/user/feature-guides/skeptic.md. Customers read the same text inside CMDash under Help. Last updated October 11, 2026.

Skeptic — CMDash Docs