# CHQ-ED-2026-005

- **Artifact ID:** CHQ-ED-2026-005
- **Public record:** https://record.cybersecurityhq.com/evidence/chq-ed-2026-005
- **Machine-record SHA-256:** `4d5d56d38654168011d40e1352ff0d4682eca352b3fd498cd2f8eace95d6910d`

## Complete structured record

```json
{
  "id": "CHQ-ED-2026-005",
  "associated_position": "CHQ-P-2026-003 v1.0",
  "relationship": "original",
  "issuance_date": "2026-03-14",
  "evidence_freeze_time": "2026-03-14T00:00:00Z",
  "total_exhibits": 2,
  "docket_status": "LOCKED",
  "docket_version": "1.0",
  "artifact_class": "EVIDENCE_DOCKET",
  "authority_level": "SUPPORTING_RECORD",
  "reliance_status": "CONTEXT_ONLY",
  "temporal_scope": "CONTEMPORANEOUS",
  "update_policy": "APPEND_ONLY",
  "exhibits": [],
  "claims": [
    {
      "claim_id": "C-01",
      "position_section": "",
      "claim_text": "The Dragos-Microsoft expanded collaboration (February 3, 2026) structures OT security as an Azure consumption commitment, eliminating the standalone OT procurement cycle for Microsoft-dominant enterprises.",
      "evidence_exhibits": [],
      "relevant_sections": "",
      "verification_type": "",
      "source_text": "Dragos Inc. announcement, February 3, 2026: four confirmed integration pillars: SaaS deployment of Dragos Platform on Azure; native OT telemetry flow into Microsoft Sentinel; procurement through Azure Marketplace with MACC alignment; coordinated go-to-market execution. Position primary signal, directly cited.",
      "evidence_class": "E1"
    },
    {
      "claim_id": "C-02",
      "position_section": "",
      "claim_text": "Procurement through Azure Marketplace with MACC alignment converts OT security spend into cloud consumption commitment, permanently closing the standalone budget cycle within the contract period.",
      "evidence_exhibits": [],
      "relevant_sections": "",
      "verification_type": "",
      "source_text": "Microsoft Azure MACC structure: spend against committed Azure consumption credits eliminates separate budget line requirement. Position governance condition: no CISO reopens a budget fight already won by reclassification. Financial lock-in is self-reinforcing across renewal cycles.",
      "evidence_class": "E2"
    },
    {
      "claim_id": "C-03",
      "position_section": "",
      "claim_text": "OT telemetry integration into Microsoft Sentinel normalizes OT alerts within IT SOC workflows, completing cognitive reclassification from OT-native category to cloud log source.",
      "evidence_exhibits": [],
      "relevant_sections": "",
      "verification_type": "",
      "source_text": "Dragos-Microsoft announcement: native OT telemetry flow into Sentinel confirmed as integration pillar. Position: the day OT telemetry looks indistinguishable from any other feed inside the SOC console, the category has already been absorbed. Technical integration precedes cognitive integration; both are structurally irreversible.",
      "evidence_class": "E2"
    },
    {
      "claim_id": "C-04",
      "position_section": "",
      "claim_text": "Microsoft’s CyberX acquisition (2020, rebranded Defender for IoT) demonstrates internal OT product failure to achieve enterprise credibility; the Dragos partnership functions simultaneously as distribution agreement and competitive intelligence pipeline.",
      "evidence_exhibits": [],
      "relevant_sections": "",
      "verification_type": "",
      "source_text": "Microsoft CyberX acquisition, 2020: rebranded Defender for IoT. Dragos partnership admits dominant OT vendor into commercial engine while internal product exists. Every byte of OT telemetry through Sentinel trains detection models on industrial protocols. Position: Microsoft historical pattern: partner, learn, absorb, bundle.",
      "evidence_class": "E2"
    },
    {
      "claim_id": "C-05",
      "position_section": "",
      "claim_text": "The global OT security market is projected at $23.5B (2025) to $50.3B (2030); the commercial question is channel structure, not market size.",
      "evidence_exhibits": [],
      "relevant_sections": "",
      "verification_type": "",
      "source_text": "Market projection cited in Position context. Pure-play OT vendor addressable base is structurally limited by organizations with ICS environments and standalone budget authority. Partnership framing: standalone OT vendor category admitted it cannot reach the remaining 80% of industrial organizations through independent distribution.",
      "evidence_class": "E2"
    }
  ],
  "signals": [],
  "linked_exhibits": [
    {
      "id": "CHQ-EX-2026-002",
      "title": "Embedded Vendor Authority in Enterprise Systems",
      "temporal_tag": "HISTORICAL 2005–2024"
    },
    {
      "id": "CHQ-EX-REQUIRED",
      "title": "Dragos-Microsoft Expanded Collaboration Announcement",
      "temporal_tag": "OPERATIONAL EXHIBIT REQUIRED — February 3, 2026"
    }
  ],
  "notice": [
    "This docket records claim-to-source mappings for CHQ-P-2026-003 v1.0.",
    "Evidence classification: E1 = primary source (named vendor announcement, confirmed commercial structure). E2 = inferential (market trajectory analysis, architectural implication reasoning).",
    "NOTE: CHQ-EX-REQUIRED flags a missing operational Exhibit. The February 3, 2026 Dragos-Microsoft announcement is the primary evidentiary event and warrants a formal Exhibit entry.",
    "Kill condition active: Position retires if a hyperscaler-aligned OT vendor reverses platform dependency within 24 months. Retirement requires formal v2.0, not silent withdrawal.",
    "Docket issued under CHQ-D-2026-ESG v1.0. Reliance recognized only when registered under CHQ-R-2026-001."
  ],
  "integrity_statement": [
    "This docket records claim-to-source mappings for CHQ-P-2026-003 v1.0.",
    "Evidence classification: E1 = primary source (named vendor announcement, confirmed commercial structure). E2 = inferential (market trajectory analysis, architectural implication reasoning).",
    "NOTE: CHQ-EX-REQUIRED flags a missing operational Exhibit. The February 3, 2026 Dragos-Microsoft announcement is the primary evidentiary event and warrants a formal Exhibit entry.",
    "Kill condition active: Position retires if a hyperscaler-aligned OT vendor reverses platform dependency within 24 months. Retirement requires formal v2.0, not silent withdrawal.",
    "Docket issued under CHQ-D-2026-ESG v1.0. Reliance recognized only when registered under CHQ-R-2026-001."
  ],
  "docket_hash": "cd4eaa3ad3f9dbb5f204cda31be6e5c371d16d7f42bfb4dbd22cf3f2784c47e8",
  "immutability_layers": [
    {
      "layer": "Layer 1",
      "protects": "CHQ-ED-2026-005 Docket Hash",
      "scope": "the evidence record (claim-to-source mapping)"
    },
    {
      "layer": "Layer 2",
      "protects": "CHQ-P-2026-003 v1.0 Position Hash",
      "scope": "the position text"
    }
  ]
}
```