An executive wants your report to say the engineer deliberately took the data — how do you answer?
answer
- observed, consistent with, not established
- answer the decision, not the adjective
- intent is rarely in telemetry
- name the test and its cost
- one broken claim discredits the rest
basics
~20 sGive him what the artefacts establish, what they are merely consistent with, and the one test that would settle the difference. Intent is almost never recorded in telemetry, and a sentence you cannot defend later discredits the findings you could.
solid answer
~50 sDo not resolve the pressure by changing a verb. Answer in three separated layers: observed — an account belonging to that engineer rendered 11,000 customer records between 14:02 and 16:40, outside any ticketed work; consistent with — deliberate collection, but also an automation holding the credential or an authorised sweep nobody recorded; not established — who was at the keyboard, and whether any data left the platform. Then be useful rather than merely cautious: name the test that would discriminate, say how long it takes, and point out the actions the business can take on risk right now — preserve, revoke, restrict — none of which need an assertion of intent. Say plainly why the firmer sentence is dangerous: the person named will contest it, and one broken claim makes a reviewer discount the observations that were solid.
go deeper
Be ready to say that a report should state what was observed separately from what it might mean, and that logs record actions rather than reasons.
Explain the three layers — observed, consistent with, not established — and be able to sort a handful of statements from a real case into the right one.
Show that you answer the decision behind the pressure: the test that would settle it, its cost, and the actions available now that need no claim about intent.
Own the boundary between finding and adjudication, and the standing agreement with legal and HR about what security asserts in writing and who decides what follows.
## The pressure is normal, and the answer is structural An executive asking for "so it was him, and it was deliberate" is not being unreasonable. He has a decision to make and a sentence he needs to be able to say out loud to a board, a customer or an employment lawyer. The failure mode is answering that need by upgrading a verb in your report — *rendered* becomes *accessed*, *accessed* becomes *took*, *took* becomes *stole* — with no new artefact behind any of the upgrades. The fix is not to hedge harder; it is to give a structure that answers his question honestly at each layer. ## Three layers, kept apart on the page **Observed.** Only things a named artefact recorded, with the artefact named. "The application audit log shows 11,000 `record.view` events on account `s.mercer@…` between 14:02 and 16:40 on 11 March. 74 of those customer ids appear on open support tickets; the remaining 10,926 do not." **Consistent with.** Plural by construction. If only one explanation is listed, you have written a conclusion and labelled it an inference. "Consistent with deliberate collection of customer data. Also consistent with an automation using this account's API token, and with authorised bulk work that was not recorded in a ticket." **Not established, and what would settle it.** "We cannot say who was at the keyboard: the audit trail's subject is a credential. We cannot say data left the platform: no export artefact exists, and the product does not audit its bulk-export path. The single test that would most change this is whether the requests carried a browser session or an API token; that takes about a day and needs the platform team." An executive can act on that. He cannot act on "I'm not comfortable saying that." ## Why intent is not in the telemetry Logs record actions, not reasons. You can sometimes observe circumstances that are *associated* with intent — access outside working hours, records unrelated to any assigned work, activity that stopped the day a question was asked — and each of those has an innocent version. The artefacts that actually speak to intent are usually not machine telemetry at all: a message, a document, a search history, an interview. If the case is going to turn on intent, the honest thing to say is which team owns getting that evidence and under what authority, not to manufacture it from a volume count. ## Separate the finding from the adjudication It helps everyone to be explicit that you are not the decision-maker. The security function's product is an accurate account of what happened. Whether that account is enough to discipline, dismiss, notify or prosecute is a decision owned by HR, legal or an executive, applying their own standard of proof. Saying so is not evasion; it is the thing that lets you keep your findings exact while the business still moves. It also protects the decision: a manager who acts on "the account rendered records outside ticketed work, and we cannot yet identify the operator" is making an informed choice, while one who acts on a borrowed certainty is exposed the moment the certainty fails. ## The cost of the firmer verb This is the argument that usually lands. A contested claim gets attacked at its weakest point. If the report asserts theft and the only support is a view count, the person named needs to break exactly that one sentence — and when it breaks, a tribunal, an arbitrator or an internal panel discounts the whole document, including the 11,000 rows that were never in doubt. Overstating does not buy certainty; it converts strong evidence into contested evidence. The reverse is also true: a report that visibly refused an easy claim is read as careful, and its remaining claims travel further. ## When nothing can settle it Sometimes the discriminating test is gone — the telemetry was not collected, or the window has passed. Say that explicitly, name what was missing and why, and describe the decision the business can still take under uncertainty. An unresolvable question stated plainly is defensible forever. The same gap covered with a stronger verb is a liability that surfaces at the worst possible moment.
- He asks for one sentence he can say in the board meeting. What do you give him?One that is true at that length: an account belonging to a named support engineer rendered about 11,000 customer records in one afternoon, almost none tied to open cases; we cannot yet show who operated the account or that any data left the platform, and we are running the test that would tell us. It answers the question, states the limit, and commits to a next step.
- What if the test that would settle it is no longer possible?Say so directly, name what was not collected and why, and shift the conversation to what can be decided under that uncertainty — restricting access, preserving what remains, asking the person. A stated gap survives scrutiny indefinitely; a gap papered over with a stronger verb fails the first time someone looks closely.
- Isn't refusing the firmer wording just protecting yourself at the business's expense?No, because the alternative costs the business more. Every action the executive can take now — revoke access, preserve evidence, involve HR, notify counsel — is available on what is already established. The firmer sentence adds no options, and it adds a claim the subject can contest, which is the one route by which the solid findings also get discarded.
A pathologist reports cause of death, not murder. The stronger word belongs to a different process, with a different standard and a different owner.
saying these in an interview costs you the question
- Upgrades consistent with to proves under pressure
- Hedges so hard the report answers no decision
- Asserts intent from the volume of access
- Leaves the surviving alternative explanations out
- Treats the executive's preferred wording as a requirement