Investigation (Un)Certainty: Top 10 Rules for Verbiage in Cyber

I wrote a very nice article about verbiage in Cyber, but it was really 10 articles in one, and the length reflects this. If you have 15 minutes to dive into background, process, and examples, go read the full article titled

“Investigation (Un)Certainty: Are you Thinking through Experience or Evidence?”

If you don’t have 15 minutes, you’re in the right place. Below are the 10 key points, straight no chaser.

Note: both the key points and descriptions were pasted directly from the article, so if you’d like explanation or enjoy the prose, check out the full version. 

The 10 Rules for Verbiage in Cyber

1. Your verbiage in your notes fuels your process.

Deliberate thoughts are actions in themselves, acting as seeds that grow and affect the thoughts around them. If you’re taking investigation notes with unfounded certainty, you are polluting your mental garden with assumptions that lead to breaches. It starts with what happens inside your head, not your SIEM.

2. Ask yourself: “Am I thinking by experience or by evidence?”

When a SIEM alert fires, your brain is primed to work in a certain direction with a certain degree of certainty. A baseline of healthy investigation requires evidence-led actions rather than a cascade of quick, unvalidated assumptions that burn 50 minutes of SOC time on quick fixes.

3. Understand that each log does not validate itself.

When pivoting across sources, continuously run three questions through your head:

• Does the evidence require validation or is it conclusive in itself?

• What evidence is required to validate this finding?

• Is the evidence required for validation available to me?

An HTTP 200 does not independently validate a successful attack chain; it indicates a successful HTTP

request success that warrants looking into additional telemetry.

4. Know your target audience.

If your incident report is going straight to the SOC Manager for a meeting with the C-Suite, focus on impact, risk management, and lessons learned. Don't write three paragraphs on cool tools the attacker used; detail that within the technical investigation report for your security engineers later.

5. Normalize your nomenclature!!

Whether you write "HTTP 200 responses found in accounting" or "Accounting breached following HTTP 200 responses," both might be technically valid, but shifting your order of subjects introduces inconsistency. In technical writing, variance subliminally lowers professional credibility and adds reader friction. Make it skimmable.

6. Make it human—AI normalizes to the point of forgettability.

AI is really good at normalizing nomenclature, but AI-written reports and summaries get filtered out by our brains and become entirely forgettable. Use AI for formatting, charts, and templates, but edit your writing so that it's distinctly yours.

7. Speak with conviction, not arrogance or fluff.

In conversation with supervisors or peers, conviction DOES NOT imply speaking overly formal, overly certain, or overly authoritative. Conviction DOES imply:

• Choosing your words

• Staying consistent with your word choices

• Having an idea of what to say before you say it

Pause, slow down, and think hard so your supervisor doesn't have to.

8. Actionable verbiage > Passive verbiage.

In your portfolio and resume, show rather than tell. "Executing" beats "practicing," and "corroborating evidence" beats "reviewing." Use active verbs (conducted, constructed, utilized) to display real execution rather than passive observation.

9. Embody the practitioner you’re applying as, not just play the role on weekdays.

Your comments, posts, and community involvement should display a coherent professional identity. Building a cohesive identity by talking, writing, posting, and commenting deliberately creates a professional coherency that stays with you as you broaden your scope across the industry.

10. We’re not performers, but we are presenters.

The essence of a hard skill is: Practice the skill have the hard skill. The essence of a soft skill is more involved: Become the process have the soft skill. Whether presenting to your manager, a peer, or just taking notes for yourself, learning the language and staying consistent will get you in—and keep you in—so many rooms you lack the resume bullets for.