An auditor asks what your 9,000 unopened medium-severity detections since March contained. What do you say?

## Why the easy answers fail Three responses come naturally and all of them collapse under one follow-up question. *They were mediums, so low risk.* Severity was assigned by the rule author before the rule knew which account, identity or data set it would fire on. A medium-severity detection covering a sanctioned cloud primitive — a snapshot shared outward, a role trusted from a new account — is exactly where a competent adversary prefers to operate, precisely because it does not look like malware. *Nothing escalated, so nothing was malicious.* Nothing escalated because nobody opened them. This is circular, and an auditor will notice. *Those rules are historically noisy.* The historical rate was measured over items that were worked. The unopened band was selected non-randomly — by severity, by which accounts are busiest, by what arrived while the single analyst was mid-investigation — so the worked-set rate does not transfer to it. ## The defensible construction ### Characterise the population Before any estimate, describe what the 9,000 actually are: which rules and rule families, which accounts and which of the three providers, the date span, the distribution of ages, and — critically — how many still sit inside their evidence retention window and how many do not. That last split determines what is even recoverable and it is the number most likely to be missing from the auditor's mental model. ### Sample it properly You cannot work 9,000 with one analyst. You can work a hundred. The sample must be **random within the band**, not convenience-drawn: not the newest hundred, not the ones with interesting-looking rule names, not the ones from the accounts you know well. A convenience sample produces a number you cannot extrapolate, and it will be the first thing an auditor probes. If the band is heterogeneous — one rule family contributing 6,000 of the 9,000 — stratify, sample within each stratum, and weight the result. Work each sampled item to the same standard you would apply to a live alert, and record the dispositions properly: true positive, benign true positive, false positive, or undetermined because the evidence had expired. That last category is a result, not a gap in the exercise. ### Report an estimate, with its uncertainty The output is a sentence of this shape: *we drew 100 at random from the 9,000; three were true positives, one of which warranted escalation and has been opened as an incident; the rest split between benign true positives and false positives; eleven could not be adjudicated because their evidence had expired.* Extrapolate with an explicit interval and say plainly that the interval is wide because the sample is small. A number with an honest interval survives scrutiny; a point estimate presented as fact does not. ### Decide in advance what happens to a hit Sampling an unworked backlog can find a real intrusion, and it sometimes does. Agree before you start who declares an incident, what the trigger is, and that the sampling exercise pauses if the estimate demands a broader look. Discovering that mid-exercise, in front of an auditor, is a bad time to invent the process. ## The organisational half, which is the actual question An auditor asking about 9,000 unopened items is not really asking an analyst to do statistics. They are asking whether the organisation knows what it is not looking at, and whether anyone with authority has been told. So present the tail as arithmetic, not as a lapse: at a capacity of roughly 40 items a day against roughly 300 arriving, an unworked band is the guaranteed output of the system as funded. Then be explicit about ownership. An analyst cannot accept this risk on the organisation's behalf; the person who owns the SOC's budget and coverage can. Your obligation is to make the tail measurable and to put the choice in front of them with the numbers attached — the estimated true-positive rate in the band, the count already past adjudication, and what a given amount of extra capacity would recover. What they then decide to do about it — fund more capacity, change what is collected, deliberately narrow coverage — is their call to make and to sign. ## What separates a strong answer The candidate who says *I would sample it* is halfway there. The one who says *randomly, stratified, worked to full verdicts, reported as an interval with the unadjudicable count broken out, and escalated as a capacity decision to the person who owns it* has understood that the auditor's question is about governance and that the statistics are how you answer it honestly rather than reassuringly.