# Criterion question: do exploitation attempts against a decoy network before disclosure satisfy Pre-Disclosure Exploitation

- **Artifact ID:** CHQ-CRIT-QUESTION-2026-004
- **Version:** 1.0
- **Status:** REFERRED TO THE Q4 AUDIT
- **Public record:** https://record.cybersecurityhq.com/governance/chq-crit-question-2026-004
- **Machine-record SHA-256:** `605f38189f248b8ace4fc7895e8f78151710cd8f24dbfd0da02052d6dbeefb3c`

## Complete structured record

```json
{
  "id": "CHQ-CRIT-QUESTION-2026-004",
  "title": "Criterion question: do exploitation attempts against a decoy network before disclosure satisfy Pre-Disclosure Exploitation",
  "class": "AUDIT",
  "version": "1.0",
  "effective": "2026-11-04",
  "published": "2026-11-12",
  "status": "REFERRED TO THE Q4 AUDIT",
  "status_detail": "Opened 4 November 2026 on an external audit. No counted set changed. Two candidates are held under it (RA-2026-046-01, RA-2026-046-02).",
  "rule": "The criterion in force is silent on whether an attempt against a decoy is exploitation. Three readings are possible: attempts suffice; confirmed exploitation of a real system is required; an authority's determination is required. Candidates that rest on attempt telemetry are held until the audit rules.",
  "scope": "SC-2026-006.",
  "authority": "DM ratified 2026-11-12"
}
```