Investigation (Un)Certainty: Are you Thinking through Experience or Evidence?
In Cybersecurity, words can carry you further than any hard skill.
Did you just complete an incident report but wrote “HTTP 200 responses signified successful compromise of company assets”? Oof.
HTTP 200s may indicate compromise, but more certainly, they indicate a request was successfully received and processed. Thanks to defense-in-depth and the wonderful fact that technology is anything but perfect, HTTP 200 is not always an IoC by itself. You need validation.
This article is specifically about how to phrase yourself when speaking about an investigation (and beyond).
Early in my studies, I made the exact mistake above–and my mentor Hayden made sure to mention it on nearly every page of his commentary. In my next months, I dedicated myself to a headache-inducing level of scrutiny so that I could speak Cyber with appropriate certainty.
Here are my findings.
——
1/2 “It’s all in the verbiage”
——
And a lot of verbiage is dangerous.
Here are the danger terms I’ve witnessed across cyber media, my projects, and other entry folks’ statements–oh, and feel free to copy these lists, I use it in my local LLM to validate my project prose on the daily.
When you’re certain of something, watch out for:
Proves
Definitely
Certainly
Undoubtedly
Conclusively
Clearly
Indicates
Means
Obviously
Guaranteed
100%
Always
Never
Impossible
Must
Must have
Shows
Caused
Caused by
Proven successful
Proven failed
What was successful?
The attacker found…
The attacker pivoted…
Vulnerabilities were found
Our webserver is not vulnerable
This displays…
This allowed the conclusion…
The attack succeeded
The attack failed
When you’re uncertain of something, watch out for:
Likely
Probably
Presumably
Apparently
Evidently
Seemingly
Indicates
Suggests
Points to
Associated with
Attributed to
Likely successful
Likely unsuccessful
Likely brute-force
Standard <attack category> activity
Attacker motivation
Most likely <explanation for attacker weapon/tool>
Could explain…
I think
I believe
I feel
I guess
Maybe
Perhaps
Sort of
Kind of
It looks like
Seems like
I couldn’t find
I don’t know
Nothing happened
No evidence exists
If vulnerable, yes
On the flip side, this prose has better alternatives. Here’s where I landed.
When you’re more certain, try:
Observed
Identified
Detected
Recorded
Established
Demonstrates
Corroborated
Validated
Confirmed
Consistent with
Evidence supports
Supported by the evidence
The record established
Jointly support
Validated by
Confirmed <attacker action>
The command expressed <blank> intent
Telemetry recorded
The investigation identified
Based on available evidence
Consistent with observed activity
High confidence of … based on …
Observed activity
Assessment
Established by the available evidence
When you’re less certain, try:
Could represent
Potential for
Potentially
Possible
Supports potential
Appears consistent with
Is consistent with
Compatible with
May suggest
Suspected
Likely, given…
med/low confidence of … based on …
Hypothesis – posited: …
Hypothesis – supported: …
… Does not establish
Does not independently prove
Cannot be determined
Insufficient evidence
Further validation required
Requires additional telemetry
Further evidence would be required
<blank> could strengthen the assessment
No evidence was identified
Not established by available evidence
Based on currently available evidence
The record did not reveal…
Available data fails to disclose…
Completion suspected based on behavior
Compromise cannot be concluded
No <attack tactic> may be confirmed
Given the lack of telemetry…
The available evidence does not establish…
Additional endpoint telemetry would be required
This could also be explained by…
And for every word and phrase, yes, there is a time and place. Please contact me on the at https://www.solvingcyber.com/contact and we’ll have a nice chat about whatever gripes my lists have summoned.
Now, the next internal rebuttal alerting your spidey senses should be, “that’s an alright argument for verbiage in reports, but I use gpt for most of mine and my supervisor doesn’t complain, I’m not going to read the rest of this article.”
That’s pretty similar to how I felt before drafting the article… but then I realized.
Verbiage follows you.
Everywhere.
Next, we’ll dive into four key areas where you have to watch your language.
——
2/2 “It’s not just in the report”
——
First: Verbiage DURING the investigation
Why would it matter how you’re taking investigation notes? No one else is reading them, so who cares?
I’m gonna get a little personal here.
I studied a smidge of religion and philosophy in my college days, and I gleaned something from Buddhism which has helped tremendously.
Deliberate thoughts are actions in themselves, i.e. thinking is an activity. And activities are how we develop, they shape our experiences–it’s why you learn more from doing than from just reading.
At that, thoughts act as seeds, they grow and affect other thought seeds around them. If you don’t believe me, try spending a week on vacation then come back to work.
The workaholic, with a mental garden polluted by thought of work, couldn’t relax. The relaxer, polluted by thoughts of vacation, couldn’t focus that first week back from vacation.
Notice that in both scenarios, I used the word “polluted”. A healthy baseline of thought and action is based on your goal.
Vacation = relax, fun.
Work = productivity, goals.
investigation = evidence-led actions.
Now let’s get a little more concrete.
Here are two areas of verbiage you must be aware of during your investigation.
(1) Self-Awareness
Okay, that’s a gimme, I know, but it gets specific. Here’s the question that should be on your mind:
“Am I thinking by experience or by evidence?”
Here’s a scenario.
You’re investigating a potential breach in accounting where your SIEM alerts you that an unknown IP has been in frequent contact with a user associated with financial records. You’re tasked with investigating it given the potential impact in (1) data loss, (2) company reputation, and (3) finances.
This is a common scenario, especially for our tabletops and lab simulations. Because of this, your brain is primed to work in a certain direction with a certain degree of certainty.
So let me ask you, which statement would you mark in your investigator’s journal to foster a healthy “mental garden”?
“IP is offshore, looks like Russia… the breach is in accounting, so probably looking at social engineering, I should do a global search for the attacker IP to figure out how long this has been going on then figure out just how much data has been transferred so we know the blast radius.”
“The SIEM flags the IP as offshore but this requires validation… the alert fired from a machine in accounting, but the data doesn’t independently establish (1) whether this is malicious or benign behavior, (2) when the first alert of this type is found, or (3) what, if anything, has been transferred. I’ll start by gathering data on the suspicious IP’s history to identify whether this is malicious or benign, and while I’m searching the SIEM for that, I’ll have an email put out to the accounting department to gather info.”
With (a), The initial pivots will take a few minutes each, but if you’re wrong? That’s a lot of quick fixes. Never forget that 10 5-minute pivots is 50 minutes. A fun 50 minutes, but one that your SOC Manager might not approve of.
(a) has a time and place, for sure–but as SOAR and AI SOC become more prevalent, a lot of the busywork/textbook examples are out of your hands. As a baseline, the (b) approach leads to a far healthier mental garden.
So here’s the sum so far:
***Your verbiage in Your notes fuels Your process***
And if you forget that, you’re prone to unconsciously fall into biases.
Some of those biases might help. Any good pentester will tell you they use a playbook that follows adversarial tactics logically, and for good reason–it’s very hard to move laterally to an admin from a local user if you haven’t enumerated the domain for admin accounts.
but
The biggest breaches aren’t always from textbook OWASP failures. A lot of times, it’s the alert you cherry-picked for evidence and labeled as an FP.
And it starts with what happens inside your head, not your SIEM.
Now to the second consideration in your investigation.
(2) Pivoting
Always remember the pipeline.
Thoughts → Actions → Words
Especially in your investigative process.
When you’re pivoting across sources, understand that each log does not validate itself. Here are the three questions I ask myself when I see evidence:
(1) Does the evidence require validation or is it conclusive in itself?
(2) What evidence is required to validate this finding?
(3) Is the evidence required for validation available to me?
I’ll use the HTTP 200 scenario again.
If you see an HTTP 200, this does not independently validate a successful attack-chain. It indicates a a successful HTTP request, requiring validation.
Your notes should look more like
“HTTP 200 warrants investigation of Sysmon 22, 3, 11, and 1 on the potentially affected endpoint”
than
“HTTP 200 indicates successful access of company network share by the adversary”
If you’re closer to the latter, you’re polluting your garden with unfounded certainty–the kinds of assumptions that lead to breaches.
Now onto the second area where verbiage counts.
Second: Verbiage in your documentation
Here’s the skinny:
(1) Know your target audience!!
(2a) Normalize your nomenclature!!
(2b) Make it human (if you have the time)
Now let’s break it down in the style of an incident report.
(1) Know your target audience
If your incident report is going straight to the SOC Manager for a meeting with the C-Suite on impact, risk management, and lessons learned, focus on impact, risk management, and lessons learned.
Don’t focus on an additional three paragraphs on cool tools the attacker used–detail that within the investigation report for your security engineers later.
Here’s how to ruin a topic sentence within the executive sum:
“HTTP 200 responses found across accounting department from IP 103[.]76[.]52[.]0 to internal IP 10[.]0[.]3[.]23 led to findings of 7,400,313 bytes of transferred data from an exposed fileshare in a 1-month timeframe at intervals spanning 1-3 days from 2026-03-10 to 2026-04-10 occurring between 01:59:58 and 03:15:12 EST.”
Here’s how not to ruin it:
“A data breach originating in our accounting department to an unknown assailant with suspected Russian ties has led to 7.4 Gigabytes of billing information and department-shared files being transferred between Q1 and Q2 due to an outdated filesharing system remaining in-use across the department.”
Note that both examples say most of the same information. For our C-Suite scenario, the good example probably reads poorly through Cyber eyes, and that’s the point. The bad example doesn’t springboard into valuable discussions in risk management and lessons learned, it leads to a very dry telling of a Cyber Sherlock Holmes episode by your SOC Manager to members of your C-Suite.
(2a) Normalize your Nomenclature!!
Let’s use the first example here.
“HTTP 200 responses found across accounting department” could also be
“Found HTTP 200 responses in accounting” or
“Accounting breached following HTTP 200 responses”
My frustration lies in the fact that all three are valid. But as you write more reports, and especially as those reports gain some volume, you need the verbiage and order of subjects to remain consistent.
If you write “HTTP 200 … accounting”, then later in the investigation backtrack but state “Accounting … HTTP 200”, it adds just a pinch of friction for the reader.
In academic writing, this is a method of maintaining variance for reader interest. In technical or professional writing, it’s a method of introducing inconsistency, subliminally lowering professional credibility and adding reader friction; a full incident report can get long, even longer than this article, so make it skimmable.
But don’t make it forgettable.
That’s where we get
(2b) Make it human
AI is
REALLY.
GOOD.
At normalizing your nomenclature.
But have you read an AI incident report? An AI technical summary? I won’t shout them out because I mean no disrespect, but I have stumbled across folks who use AI to format their GitHubs but keep the AI prose through and through… and I don’t remember a lick of any of those repos.
AI normalizes to the point of forgettability. It helps tremendously in formatting your report, creating charts and templates, and its statements are direct, effective, logical, no doubt there– but as we get used to AI writing, our brains filter it out and it becomes forgettable. I mean, you probably just saw the em-dash there and rolled your eyes, and that’s exactly my point (although I’ve always used em-dashes so get used to it).
This is definitely a personal opinion, but please edit your writing so that it’s yours. I know it’s going to happen, but I am not looking forward to reading someone’s incident report and internally screaming “OKAY GPT WE GET IT” after the 50th symmetrical conclusion.
This leads us to the part that is and will (hopefully) always be human.
Third: Verbiage in conversation
This is where tending that mental garden comes to fruition.
I spent 6 years as a private teacher, averaging ~20 students weekly across my tenure. My first year, I had mostly kids, and they walked all over me.
I lacked conviction. I had know-how, I got the job, but my flow was off.
“Well you could play this beat, or maybe use these sticks, oh and you want to buy a drumset? Yeah just look it up, find what you like.”
I should have said, “try this beat, start with these sticks, here are two drumset options I like.” Limiting? Kind of. But my job was to guide, make it easier for my students to make choices. And our jobs in cyber are not too different.
So how do you speak with conviction in Cyber?
Let’s start with the negatives.
Conviction DOES NOT imply speaking
Overly formal
Overly certain/uncertain
Overly boring/dry
Overly authoritative
So what does it imply?
Conviction DOES imply
Choosing your words
Staying consistent with your word choices
Having an idea of what to say before you say it
What does conviction look like?
An incident occurred and you’re on call with your supervisor.
(Good example)
Supervisor: “What assets were involved?”
Analyst: “Confirmation has not been validated, but reasonable suspicion of assets 1/2/3 being compromised, warranting a look into assets 4/5/6. Is <evidence type> available to my team so I can confirm blast radius and move forward toward recovery?”
Bad example
Supervisor: “What assets were involved?”
Analyst: “We investigated assets 1/2/3, so it’s safe to say that assets 4/5/6 were hit, too. So we’re looking at <actions> for recovery, but we’ll need a few more sources to give you a good damage sum. We can find that if you send us <evidence type> for assets 4/5/6.”
Note the verbiage.
For the good example, you better believe I’m taking a brief pause and talking a bit slower. Not gonna say “uhh” every few seconds, but I’m thinking hard so that my supervisor doesn’t have to.
For the bad, notice how much was assumed, how variable the nomenclature was (“damage sum” instead of “blast radius”), and how cocky it came across. “If you send us” as opposed to “is <evidence type> available”.
You might land on the same result in both, but in the good example, you’re giving your manager a very direct way to be useful. In the bad, you’re insinuating the manager was hiding something crucial. Not a fireable offense, but these things add up–especially in your mental garden.
This leads us to the last area of interest, your portfolio.
Fourth: verbiage in your portfolio
For this last bit, I’ll use an example from my resume.
On July 9th 2026, a project bullet read
“Conducted a 20-hour Splunk investigation aligned with NIST SP 800-61r2, practicing alert triage, evidence review, incident scoping, and documentation.”
Good verbiage:
Conducted
Aligned with
Weak verbiage:
Practicing
Review
Your portfolio should display a degree of learnability, but in this case, I should have done more showing than telling. Maybe instead of practicing, I could write “simulating”, “enacting”, “executing”. It’s a practice drill, but the action is the same even if the adrenaline is lacking. Same deal with “review”--not a bad word in itself, but I could have shown more, something like “collection”, “corroboration”, “tracing evidence”.
Just like conversation, your portfolio needs a degree of conviction. In this case, it’s simpler.
Actionable verbiage > Passive Verbiage
Execution is actionable. Practicing is a bit of a grey area.
Corroboration is actionable. Review is a passive descriptor.
So what does the bullet look like on October 2nd 2026?
“Conducted a 20-hour investigation using Splunk, Suricata IDS, and FortiGate UTM telemetry to scope activity and construct an evidence-supported timeline following NIST SP 800-61r2.”
Now that’s a glow-up.
Not only is my verbiage actionable, but I’m tying multiple bullets together without losing coherency or keyword stuffing.
Good verbiage:
Conducted
Using
Construct
Evidence-supported
Weak verbiage:
Scope activity
Following
I know it’s my portfolio and I’m literally writing an article on verbiage, but yeah, there’s some weakness. “Scope activity” is unclear, albeit potentially strong. “Following” is passive, I should edit it as “utilizing”, “under the”, or just “using”.
The focus here was on active versus passive verbiage in your resume, but there are numerous examples across LinkedIn, other areas of the resume (mission statement, work experience), cover letters, and of course, any professional conversation you have online.
The scope of this article is too narrow to do a deep dive into all things people and publicization, but I do want to mention some key points.
Your comments, posts, and community involvement should display a coherent professional identity. This is something Hayden has helped me with tremendously.
You want to embody the practitioner you’re applying as, not just play the role on weekdays.
I came to the space as a musician, and when I learned of Cybersecurity I accidentally studied offensive security before defensive. Upon realizing this, I was incredibly careful about my first LinkedIn posts, and I will probably never share the drafts that didn’t get published… they’re kinda rough.
But I practiced and made mistakes. I’m still practicing and making mistakes. And every day I become more cohesive as a Cybersecurity practitioner.
As my interests broaden toward GRC, Purple Teaming, SysAdmin, what have you, there’s a kind of professional coherency I’ve built by talking, writing, posting, commenting, getting involved deliberately. That coherency won’t leave me just because I build beyond my Analyst foundations.
I’d love to discuss metrics in publicization verbiage in private, but my opinions fail to provide actionable conclusions; further evidence required through metrics of job acquisition, network connections, and events participated required to validate current posited hypotheses. (see what I did there?)
Now to address the elephant I’ve spawned through this article. This is what you’re probably thinking by now
“Okay but that’s a lot of work”
Yeah, it is.
But have you ever dissected a soft skill? Ever met someone and thought, “wow what a great character they have” followed by “how can I semi-quantifiably measure their character and create metrics to work on so I can become like that”?
Yeah, it’s heavy. But it’s so worth it.
Speaking from my past career, learning the language and staying consistent will get you in–and keep you in–so many rooms you lack the resume bullets for.
The essence of a hard skill is:
Practice the skill → have the hard skill
The essence of a soft skill is more involved:
Become the process → have the soft skill
(Sidenote: To develop a better concept of skill building, I’d recommend pairing a reading of Atomic Habits with Zen and the Art of Archery.)
Now to wrap this up in a nice little bow
“Sum: We’re not performers, but we are presenters”
Even if it’s just your manager
Even if it’s just your peer
Even if it’s just your self
Deliberate thought is an action, and all thought and actions populate and tend to your mental garden. If you cultivate a healthy mental garden, you’ll find yourself having much greater coherency whether in the investigation, documenting, speaking with others, or publicizing yourself.
This was a long one, so thanks for bearing with me. As per usual, Cybersecurity is a jigsaw puzzle, and I’m hoping that whether you’re senior, junior, or just cyber-curious, this article sparks the kinds of discourse that leads to SolvingCyber.
See you in the next one.
