Field Notes · Incident Command August 21, 2026 · 6 min read

Evidence gaps are findings.

Every real investigation runs into things it cannot examine: logs that were never enabled, retention windows that expired, systems reimaged before collection, assets outside the agreed scope. The instinct is to treat these as administrative footnotes. They are not. Gaps directly bound what can responsibly be concluded, and the conclusions carry the decisions: notification, disclosure, closure, litigation posture. This note explains why gaps belong in the findings, how an executive should read an incident report so the gaps become visible, and why logging retention is a governance decision made years before the incident that exposes it.

The mechanism: gaps bound conclusions, conclusions carry decisions

An investigative conclusion is a claim about what happened, supported by evidence that was available. Its strength is capped by the coverage of that evidence. "No data left the environment" can only ever mean "no data movement was observed in the sources we examined, during the periods they cover." If egress logging did not exist for the relevant window, the conclusion has not weakened slightly; it has changed category, from a supported determination into an unknown wearing conclusive language.

Decisions then inherit whatever the conclusions actually carry. Whether customers must be notified depends on what was accessed. Whether disclosure obligations arise depends on scope and materiality. Whether an incident can responsibly be closed depends on what remains unexamined, which is the subject of the companion note on containment and closure. A gap that bounds a material conclusion is therefore not metadata about the investigation. It is part of the answer, and it needs to travel with the answer, at the same prominence, to the people making the decision.

Where gaps actually come from

Naming the common sources matters, because several of them are decisions the organization made long before the incident, which is what makes them governable:

• Telemetry that never existed. Logging not enabled, or enabled at a level that records that something happened but not what: a common default in cloud services, where meaningful audit detail frequently sits in higher-priced tiers, and in internal systems where verbose logging was traded for storage cost or performance.
• Retention that expired. The intrusion is discovered in month six; the logs roll at ninety days. Everything before the window is reconstruction from secondary artifacts, if it is anything at all. Dwell times regularly exceed retention windows, and when they do, the earliest and most important chapters of the timeline are the ones missing.
• Evidence destroyed by response. Systems reimaged by well-meaning operators before collection, volatile memory lost to a reboot, ephemeral infrastructure that recycled itself on schedule. The first hours of an incident are frequently the most destructive to evidence, and the destruction is done by the defenders.
• Scope boundaries. The investigation examined what it was engaged to examine. Subsidiaries, third-party processors, SaaS tenants, personal devices, and legacy environments outside the scope are silent in the report, and silence reads as clean unless the boundary is stated where the conclusions are read.
• Third-party opacity. Evidence held by vendors and providers, available only through their support processes, their timelines, and their willingness. What the provider cannot or will not produce becomes a gap the organization did not choose and cannot close.

How gaps disappear from reports

Almost no competent investigation hides its gaps. They are disclosed, accurately, in the scope section, the methodology appendix, and the caveat sentence under each finding. They disappear anyway, through compression. The report's executive summary states conclusions; the briefing deck compresses the summary; the board minute compresses the briefing. Each compression step preserves the determination and sheds the bounding, because the bounding reads as technical detail. Three translations later, "no evidence of data access within the examined systems, noting the limitations described in Appendix C" has become "the investigation found no data was accessed." Every step was made in good faith, and the final statement says something the evidence does not support.

This is why the discipline has to live at the reading end as well as the writing end. A report that states its limits honestly protects no one if the limits are shed before they reach the decision.

Reading an incident report so the gaps are visible

An executive, director, or GC can apply this discipline without forensic expertise. For each conclusion that matters to a decision, ask four questions of the report or its authors:

1. What kind of statement is this? Sort each material conclusion into one of three bins: observed (supported by direct evidence), bounded (a "no evidence of" statement, true within stated coverage), or undetermined (the report says, or should say, that the question cannot be answered). The sorting exercise itself usually redistributes confidence more accurately than any briefing.
2. For every bounded statement: what was the coverage? Which sources existed, for which systems, over which dates. The answer converts the statement's apparent strength into its actual strength.
3. What was out of scope, and does any decision depend on it? If notification depends on data the subsidiary's systems held, and the subsidiary was out of scope, the notification decision is currently resting on nothing.
4. Which gaps are resolvable at a price, and which are permanent? Some gaps close with more work: additional collection, provider requests, deeper analysis of held evidence. Others, expired retention above all, are permanent. The resolvable ones are an investment decision; the permanent ones are a risk-acceptance decision. Both are decisions, which is the point.

Handled this way, a gap stops being a quiet defect and becomes what it actually is: an explicit input to the decision, priced and owned.

The pre-incident half of the argument

If gaps bound conclusions, then the organization's logging and retention posture is deciding, today, what its investigators will be able to conclude in some future incident. NIST's log management guidance has made this point for years: what is collected, at what detail, retained for how long, is a policy decision with consequences far beyond operations. The executive translation is direct. A retention window is a bet on maximum dwell time. A logging tier is a bet on which questions will matter. These bets are currently being made, in most organizations, by whoever owns the storage budget, without anyone framing them as decisions about future evidence. A leadership team that has absorbed this note's argument should ask one question outside of any incident: for the three incidents that would hurt us most, what would we be able to conclude with what we log and retain today? The answer is frequently uncomfortable, and it is vastly cheaper to be uncomfortable before the incident than during it.

The strongest objection

The practical objection is that exhaustive gap enumeration paralyzes decision-making: every investigation has hundreds of theoretical limitations, and a report that catalogs all of them buries the signal it exists to deliver. The objection is correct about exhaustiveness and wrong about the remedy. The filter is materiality: a gap earns prominence when it bounds a conclusion that a pending decision depends on. Retention gaps that limit the intrusion timeline are material when closure is being decided; a logging limitation on a system nobody touched is not. The discipline is not "list every limitation." It is "no material conclusion travels without its bounds." That formulation keeps reports readable and keeps decisions honest, and it gives report authors a defensible rule for what to elevate.

Conclusion

What an investigation could not see is part of what it found. Gaps in telemetry, retention, scope, and third-party visibility set the ceiling on every conclusion, and the decisions built on those conclusions inherit the ceiling whether or not anyone states it. The failure mode is rarely dishonesty; it is compression, as accurate caveats are shed on the way up the reporting chain. The protections are procedural: sort conclusions into observed, bounded, and undetermined; demand coverage behind every "no evidence of"; price the resolvable gaps and formally accept the permanent ones; and, before any of it, treat logging retention as the decision about future evidence that it is.

← All Field Notes