Vantage: why a capture states where it stood

The problem vantage solves

A network scan run from a router cannot see link-layer neighbor advertisements at any privilege level — that is how a conforming bridge works, not a failure of the tool. Without a declared vantage, that structural limit is indistinguishable from a genuine finding: "no adjacency observed" reads the same whether the fabric has none or the scanner simply stood somewhere that could never see it.

Consulting workshops and CMDB exports have the same blind spot without a name for it. A diagram is silently wrong in the same way — the interview did not reach that segment — but nothing on the page says so.

What vantage means in practice

Vantage is where a capture stood when it ran — on the segment, behind a mirrored port, across a router, or built from supplied files. It is declared up front, not inferred after the fact, so a structural limit reads as a stated boundary instead of an unexplained gap.

It is an explicit input to a capture, never inferred from what the capture happened to observe. Inferring it would reintroduce the exact ambiguity vantage exists to remove: a run that saw nothing because it stood in the wrong place would look identical to a run that saw nothing because there was nothing to see.

Why this matters for defensible evidence

Read-only API capture from management planes records vantage alongside every capture, so the witness bundle carries the boundary along with the finding. A reviewer reading a gap in the compliance report can trace it back to a stated observation point instead of taking scope on faith.

This is the same honesty standard behind reproducible witness bundle — you or any third party can re-derive each conclusion from its source evidence, within the engagement scope — a third party should be able to re-derive not just what was found, but what the capture was positioned to find in the first place.

How it shows up in your deliverables

Fixed fee · 4–6 weeks. Advisory, not formal attestation.

• Structural limits stated as a property of where the capture stood, not phrased as an apparent gap
• Partial network visibility labeled explicitly rather than left to look like complete coverage
• Recovery runbooks and gap analysis built on adjacency claims your reviewers can trust