What it means
Uncertainty is the gap between the facts you have and the facts needed for a sound decision. You may not know whether a system is exposed, whether a control works, or whether a suspicious event caused harm. Writing these gaps down prevents assumptions from quietly becoming conclusions.
Not every unknown deserves the same investigation effort. Focus first on information that could change the response or priority. Distinguish an unknown fact from an estimate with a range of possible values. You can make a proportionate decision before every question is answered, provided its assumptions and limits remain clear.
AN ILLUSTRATIVE SCENARIO
A clinic account alert
A clinic receives an alert about a staff account signing in from an unusual location. The analyst knows the time and account name but has not confirmed whether the employee traveled, whether the address represents a shared network, or whether patient records were opened. The analyst writes those questions explicitly, contacts the account owner through a trusted channel, and checks application activity. Until that evidence arrives, the alert remains suspicious activity requiring investigation, rather than a confirmed disclosure.
Put it to work
- Separate observed facts, interpretations, and missing information in the case note or risk record so another reader can distinguish them.
- Prioritize unknowns that could change the decision; assign each an owner, a source to check, and an appropriate deadline.
- State what you will do while information is incomplete, why that action is proportionate, and when you will revisit it.
How to check your work
Review the final note for unsupported certainty. It should explain which unknowns were resolved, which remain, and how the remaining gaps affect confidence and the next action.
Connect the ideas
- Evidence
A record you are willing to cite in a decision, with enough provenance to explain what it can prove.
- Likelihood
How plausible it is that a threat will cause a loss in this environment, given exposure and evidence.
- Risk
The potential for harm, assessed using what could happen, how likely it is, its impact, and what remains uncertain.
- False positive
An alert that did not represent the harmful event the detector was meant to catch.