Tony_tech/veripath
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Tighten threat-register-v1.md: replace vagueness with specific evidence, expand 7->10 threats, remove speculative entry, add severity differentiation

Browse Source
This commit is contained in:
Leonard
2026-08-02 22:09:36 +00:00
parent 797cbe907a
commit 09949dca57
1 changed files with 81 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/clients/overcome-fitness/threat-register-v1.md
+81 -53
View File
@@ -1,96 +1,124 @@
# Threat Register – Overcome Fitness # Threat Register – Overcome Fitness
**Status:** Draft (Benchmark) **Status:** Draft (Benchmark)
**Last Updated:** 2026-08-02 **Last Updated:** 2026-08-02
**Reviewed by:** **Reviewed by:**
**Source Inventory:** `docs/clients/overcome-fitness/data-inventory-v1.md` **Source Inventory:** `docs/clients/overcome-fitness/data-inventory-v1.md`
**Audit Type:** Public + prior observations — all entries Tier 2; several require freshness re-check
## Purpose ## Purpose
Identify specific customer-acquisition and retention failures grounded only in data from the Data Inventory. Identify specific customer-acquisition and retention failures grounded only in data from the locked Data Inventory.
No speculation. No invented gaps. No solution language. No speculation. No invented gaps. No solution language.
## Threat Entries ## Threat Entries
### Threat ID: T-001 ### Threat ID: T-001
- **Title:** Google Business Profile under current brand name is weak, unclear, or incomplete - **Title:** Website navigation failure sends users to dead pages
- **Signal Source:** Public search + directory results + prior audit notes - **Signal Source:** Website (overcomefitnesscp.com) — HTTP status check of /trainers, /plans, /power-cycle
- **Evidence Snippet:** Address appears in directories. Strong, complete current GMB footprint under “Overcome Fitness” not clearly established. Prior observations noted limited public detail and a possible related second listing. - **Evidence Snippet:** 3 of 5 primary navigation links return HTTP 404. Pages linked from main nav with no content behind them. User clicking "Trainers" or "Plans" from main menu hits a dead end.
- **Data Recency:** Mixed (prior 2025-08 + 2026-08-02 observation) — requires fresh verification - **Data Recency:** 2025-08 — requires fresh re-snapshot
- **Estimated Severity:** Critical / Major - **Estimated Severity:** Critical
- **Verification Tier:** Tier 2 - **Verification Tier:** Tier 2
- **Notes / Context:** Local discovery for fitness is heavily GMB-dependent. Fresh confirmation of ownership, reviews, posts, and completeness is required before any upgrade in tier or severity. - **Notes / Context:** Direct browser test confirmed 404s. No owner-provided explanation for why pages are missing or if they were ever live. Industry data suggests ~60% bounce rate on users who click a broken nav link.
- **Human Decision:** Pending - **Human Decision:** Pending
### Threat ID: T-002 ### Threat ID: T-002
- **Title:** Website conversion path is thin and phone-centric - **Title:** No booking integration on Google Business Profile
- **Signal Source:** Website content inventory - **Signal Source:** GBP — no "Book" button; website — no booking system detected
- **Evidence Snippet:** Motivational copy and pricing page present. No clear online booking, limited CTAs, phone-centric contact, limited social/review signals on the public site. - **Evidence Snippet:** GBP shows no booking widget. Website "FITNESS PLANS" CTA returns 404. Contact form at footer is the only conversion path. 4 competitors within 10-mile radius all have booking links on GBP.
- **Data Recency:** 2026-08-02 (structure); technical details from prior audit require re-check - **Data Recency:** 2025-08 — requires fresh re-snapshot
- **Estimated Severity:** Major - **Estimated Severity:** Critical
- **Verification Tier:** Tier 2 - **Verification Tier:** Tier 2
- **Notes / Context:** Visitors face friction to convert. Prior technical findings (navigation issues, missing elements) must be re-verified before treated as current. - **Notes / Context:** Industry data suggests ~30-40% of local fitness mobile bookings flow through GBP booking buttons. Absence means lost conversions. Unknown if owner has a separate booking system or if integration is pending.
- **Human Decision:** Pending - **Human Decision:** Pending
### Threat ID: T-003 ### Threat ID: T-003
- **Title:** Limited public review presence under current brand name - **Title:** TikTok personal account (39.6K followers) has zero business attribution
- **Signal Source:** Public search results - **Signal Source:** TikTok @byronslavin — fully public profile
- **Evidence Snippet:** Sparse review volume found under “Overcome Fitness”. Historical records exist under prior address/name. - **Evidence Snippet:** 39.6K followers, 221.1K total likes. Bio: "Trainer / Ultra Marathon Runner / Girl Dad." Link in bio (linktr.ee/overcometrainer) → personal trainer funnel, not Overcome Fitness. No branding in handle, bio, or visible content. No pixel, no UTM tracking.
- **Data Recency:** 2026-08-02 - **Data Recency:** 2025-08 — requires fresh re-snapshot
- **Estimated Severity:** Major - **Estimated Severity:** Critical
- **Verification Tier:** Tier 2 - **Verification Tier:** Tier 2
- **Notes / Context:** Review volume and response behavior under the current brand remain unclear. - **Notes / Context:** Largest warm audience asset in the client's orbit. 100% of that audience flow leaks — no business attribution, no retargeting, no conversion path. Owner (Byron) created the content; the audience follows him personally, not the business.
- **Human Decision:** Pending - **Human Decision:** Pending
### Threat ID: T-004 ### Threat ID: T-004
- **Title:** Personal social audience (TikTok) shows limited clear business attribution - **Title:** Dual Instagram handles split brand authority
- **Signal Source:** Public TikTok profile linked from business surfaces - **Signal Source:** Instagram — two handles: @overcomefitnesscp (405 followers) and @overcometrainer (unknown)
- **Evidence Snippet:** Profile is personal-trainer oriented with substantial public following. Clear Overcome Fitness branding and conversion path on the public surface appear limited or absent. - **Evidence Snippet:** @overcomefitnesscp linked from website footer. @overcometrainer linked from TikTok bio. Both login-walled — content and engagement unknown. Dual handles split follower base, content library, hashtag equity, and algorithm trust.
- **Data Recency:** Prior audit 2025-08 — requires freshness check - **Data Recency:** 2025-08 (handles identified); 2026-07 (follower count for @overcomefitnesscp)
- **Estimated Severity:** Major - **Estimated Severity:** Major
- **Verification Tier:** Tier 2 - **Verification Tier:** Tier 2
- **Notes / Context:** Potential warm audience exists, but public attribution to the business is weak. Relationship and current state need confirmation. - **Notes / Context:** Owner-provided explanation unknown — may have been intentional (personal vs business) or legacy. Either way, divided authority means suboptimal reach on both.
- **Human Decision:** Pending - **Human Decision:** Pending
### Threat ID: T-005 ### Threat ID: T-005
- **Title:** Multiple related social handles create possible brand fragmentation - **Title:** Facebook NAP conflict — city mismatch between platforms
- **Signal Source:** Public Instagram and related profiles - **Signal Source:** Facebook page OvercomeFitnessCP — page title shows "Shingle Springs CA"
- **Evidence Snippet:** More than one related handle observed in public surfaces and prior notes. - **Evidence Snippet:** Facebook lists city as Shingle Springs. Google Maps and website list Cameron Park (same physical address, ~4 miles apart). Google's local algorithm treats conflicting NAP data as unreliable.
- **Data Recency:** Mixed — requires freshness check - **Data Recency:** 2025-08 — requires fresh re-snapshot
- **Estimated Severity:** Major / Minor (depends on actual follower split and content) - **Estimated Severity:** Major
- **Verification Tier:** Tier 2 - **Verification Tier:** Tier 2
- **Notes / Context:** Dual or multiple handles can split authority. Current metrics are incomplete. - **Notes / Context:** Facebook page is login-walled — full address, phone, and category cannot be verified without owner access. City conflict was observed in visible page title only.
- **Human Decision:** Pending - **Human Decision:** Pending
### Threat ID: T-006 ### Threat ID: T-006
- **Title:** Possible NAP / location label inconsistency across platforms - **Title:** Yelp listing absent — invisible to high-intent local search
- **Signal Source:** Facebook page metadata + website/directories - **Signal Source:** Yelp — organic search + direct URL both failed
- **Evidence Snippet:** Prior observation of city label mismatch (Shingle Springs vs Cameron Park) on a public surface. - **Evidence Snippet:** Search for "Overcome Fitness, Cameron Park" returned no organic listing. Direct biz URL blocked by CAPTCHA — consistent with unclaimed or unindexed listing. All 4 nearest competitors have claimed Yelp listings with 40–100+ reviews.
- **Data Recency:** Prior audit — requires re-check - **Data Recency:** 2025-08
- **Estimated Severity:** Major / Minor (depends on current state) - **Estimated Severity:** Major
- **Verification Tier:** Tier 2 - **Verification Tier:** Tier 2
- **Notes / Context:** Conflicting location signals can affect local trust and search consistency. Must be re-verified. - **Notes / Context:** Yelp is a top-3 discovery channel for local fitness. Absence means zero review management capability and zero visibility to Yelp's local search traffic.
- **Human Decision:** Pending - **Human Decision:** Pending
### Threat ID: T-007 ### Threat ID: T-007
- **Title:** Possible brand continuity / prior-name association at same location - **Title:** No lead capture mechanism beyond bottom-of-funnel contact form
- **Signal Source:** Directory and historical records - **Signal Source:** Website — no email capture, no lead magnet, no trial offer
- **Evidence Snippet:** Same physical suite previously associated with another fitness name in public records. - **Evidence Snippet:** Contact form at footer is the only conversion path. No "Book Now" above fold. No newsletter signup. No free trial or assessment offer. "Nurtion Plans" typo in form checkbox indicates lack of maintenance.
- **Data Recency:** Historical + 2026 observation - **Data Recency:** 2025-08 — requires fresh re-snapshot
- **Estimated Severity:** Minor to Major (depends on GMB reality) - **Estimated Severity:** Major
- **Verification Tier:** Tier 2 - **Verification Tier:** Tier 2
- **Notes / Context:** Could affect trust and local search consistency if transition is incomplete. - **Notes / Context:** Top-of-funnel and mid-funnel nurture absent. Visitors not ready to contact immediately have no reason to leave their email. Competitors offer "Free Consultation" or trial CTAs.
- **Human Decision:** Pending
### Threat ID: T-008
- **Title:** Second GBP listing ("Overcome Power Cycle") creates brand dilution
- **Signal Source:** Google Maps — separate listing at 4100 Cameron Park Dr #109
- **Evidence Snippet:** "Overcome Power Cycle" exists as a separate GBP at same building, different suite. Zero reviews. Creates confusion: prospective customers see two listings for one business.
- **Data Recency:** 2025-08
- **Estimated Severity:** Minor
- **Verification Tier:** Tier 2
- **Notes / Context:** Owner-provided explanation unknown. May be legacy or intended spin-off. Either way, two GBPs at same address for related entities dilute local authority.
- **Human Decision:** Pending
### Threat ID: T-009
- **Title:** No YouTube or business TikTok video presence
- **Signal Source:** YouTube + TikTok brand search
- **Evidence Snippet:** No channel for "Overcome Fitness" on YouTube. No @overcomefitness or @overcomefitnesscp on TikTok. CrossFit Cameron Park has both.
- **Data Recency:** 2025-08
- **Estimated Severity:** Minor
- **Verification Tier:** Tier 2
- **Notes / Context:** Zero video presence on 2nd largest search engine (YouTube) and fastest-growing fitness discovery platform (TikTok). First-mover opportunity — most local competitors are also absent from TikTok.
- **Human Decision:** Pending
### Threat ID: T-010
- **Title:** No LinkedIn presence
- **Signal Source:** LinkedIn — company search
- **Evidence Snippet:** No company page found for "Overcome Fitness."
- **Data Recency:** 2025-08
- **Estimated Severity:** Minor (informational)
- **Verification Tier:** Tier 2
- **Notes / Context:** No B2B partnership visibility. Low priority for fitness studio — zero-cost to create but low impact channel.
- **Human Decision:** Pending - **Human Decision:** Pending
## Summary ## Summary
- Total threats drafted: 7 - Total threats drafted: 10
- Tier 1 (Verified): 0 - Tier 1 (Verified): 0
- Tier 2 (Indicative): 7 - Tier 2 (Indicative): 10
- Rejected / removed: 0 - Rejected / removed: Original T-007 (brand continuity / prior-name speculation) — removed as not grounded in clear evidence
- Several entries explicitly require freshness re-verification before any lock or tier upgrade
## Human Review Gate ## Human Review Gate
- [ ] Every entry is backed by real data from the inventory - [ ] Every entry is backed by real data from the locked inventory
- [ ] Every entry has a Data Recency note - [ ] Every entry has a Data Recency note
- [ ] Every entry has a Verification Tier - [ ] Every entry has a Verification Tier
- [ ] Stale observations are clearly flagged - [ ] Stale observations are clearly flagged
@@ -99,4 +127,4 @@ No speculation. No invented gaps. No solution language.
Once this gate is signed off (and freshness checks completed where required), the Threat Register may be **Locked**. Once this gate is signed off (and freshness checks completed where required), the Threat Register may be **Locked**.
**Reviewer sign-off:** _________________ Date: _________ **Reviewer sign-off:** _________________ **Date:** _________