How do you present a quarter with no intrusion as evidence a detection programme worked?

## The problem with the headline number A report whose top line is 'zero incidents' asks the reader to accept an unfalsifiable claim. Worse, it is read two ways by two audiences in the same room: the security team hears 'the programme held', the budget holder hears 'nothing was going to happen anyway'. The fix is to change what the report is about - from **what did not happen** to **what the programme observably did**. ## The evidence inventory, graded by what each item proves **Near-misses and early-contained cases.** A case detected and shut down before impact is the closest thing to positive proof that the loop worked end to end. Report each with the record that started it, the source it came from, the time from first observable to containment, and the impact you could and could not rule out. Example shape: a third-party application consent granted in the identity provider by an employee, spotted in the SaaS audit trail, consent and refresh tokens revoked inside an hour, no mailbox access observed. **Proves:** the source was collecting, the detection fired, a human reached the right verdict, and the response executed. **Does not prove:** anything about behaviours in parts of the estate with no equivalent source. **Benign true positives.** Alerts where the rule correctly identified the behaviour but the actor was authorised. These are often dismissed as noise, and in a quiet quarter they are among your best evidence: they show the sensor was live and the analyst judgment was sound. **Proves:** rules were firing on real behaviour and were being adjudicated correctly. **Does not prove:** that the same rules would catch an unauthorised actor performing the behaviour deliberately quietly. **Executed-technique results.** Adversary behaviours deliberately run against production, recorded by the stage they reached - telemetry present, detection fired, analyst acted, response landed. **Proves:** the pipeline works for those techniques, on those hosts, at that hour. **Does not prove:** anything about untested techniques, which must appear in the same table. **Source coverage.** Which parts of the estate were feeding the platform for the whole period and which had no source at all. A quarter is only as quiet as the places you were looking, and stating the unlit areas yourself is far stronger than having them found. **How cases arrived.** The split between findings your own detections raised and findings someone else told you about - a supplier's breach notification naming your tenant, a report from an employee, an external notification. A quarter whose only findings arrived from outside is a quarter your sensors did not contribute to, and that ratio is one of the few honest programme metrics available when nothing was declared. ## Write the competing reading yourself The reading you are most exposed to is: *we saw nothing because our sensors were blind.* Put it in the report in your own words, then show what you did to test it. The discriminators are the ones above - sources demonstrably reporting throughout the period, techniques executed and caught, cases detected internally rather than reported to you. Where you cannot discriminate, say so and name the gap. This is not humility for its own sake. A report that only advances one reading of the evidence is an advocacy document, and the moment a sharp reader constructs the alternative on their own, the whole set of numbers is retrospectively suspect. Stating it first makes you the person who tested it rather than the person who omitted it. ## What not to claim - Do not claim breaches prevented. You cannot count events that did not occur, and the moment you assert a number you cannot defend, the rest of the report inherits the doubt. - Do not present a coverage percentage over a framework's full technique matrix as though it were a measured figure. - Do not quote a mean time to detect over a quarter with two cases in it. A mean of two is an anecdote wearing a statistic's clothes; report the cases individually. - Do not report the alert-closure ratio as an accuracy score without saying it is computed only over alerts that fired. ## The shape that lands One page: what we observed and shut down, with times; what we deliberately tested and what happened; where we were and were not looking; the alternative explanation and how we tested it; and the two or three decisions we want from this audience. Everything else is an appendix.