Reliability of application-generated data for security evidence