Transition to Risk
Four phases complete. The next begins.
Alert answered what fired. Subject answered who acted. Scope answered how much of this matters. Uncover answered what actually happened. Risk now asks is the picture complete enough to act on, or do we need to keep looking?
What Risk actually does
Risk is the analytical checkpoint that follows evidence gathering: it evaluates whether Uncover’s output is complete enough to draw a conclusion, then makes a constrained call, close with confidence, escalate, or rescope and continue. How that evaluation works is the Risk chapter’s subject; this page is about handing it evidence worth evaluating.
What Uncover hands forward
A clean Uncover handoff makes Risk’s job possible. Five Artifacts Digital evidence or traces left behind by system activity or security incidents, used in forensic analysis and incident investigation. cover what Risk needs.
📊 The evidence chain
What happened, in order, with timestamps. Each step linked to the data source that confirmed it. Mapped to MITRE ATT&CK techniques where applicable.
🎯 Confirmed entities
Which of Scope’s primary and secondary entities were actually involved in the activity. Which were investigated and ruled out. Each verdict with its supporting evidence.
🌐 Intelligence context
Which threat-intelligence sources matched, at what confidence, with what corroboration. Where the intel was hypothesis-only vs. directly evidenced.
🚧 Coverage gaps
Tools, telemetry, retention, and visibility limits that bounded the investigation. Explicit names of what could not be examined and why.
🛠️ Detection gaps
Techniques observed but not flagged automatically. Rules that fired but should have been more specific. Feedback the detection-engineering team can act on.
Common Uncover-to-Risk failure modes
Uncover can be thorough and still fail at the handoff to Risk.
🪞 Evidence without confidence labels
Uncover produced a chain but did not say “high confidence on the first three steps, medium on the fourth, low on the fifth” (per the shared rubric). Risk inherits a chain that looks more certain than it is, and the close/escalate/rescope decision is made on shaky ground.
📭 Silent coverage gaps
Uncover did the work it could but did not name what it could not see. Risk closes the case without realizing a key telemetry source was offline during the relevant window. The case re-opens a week later when the data lands.
🎭 Premature attribution
Uncover claimed attribution at high confidence on isolated technical indicators. Risk inherits a verdict that survives only as long as no one questions the attribution. The methodology asks for explicit confidence on every attribution claim.
📚 Free-form prose instead of ATT&CK
Uncover wrote a narrative that does not map to the framework. Risk has to translate before it can compare against prior cases, against threat intelligence, or against detection-engineering gaps. The chain of techniques is what makes the handoff portable.
What a clean Uncover-to-Risk handoff reads like
Threat An actor (or capability) with intent and means to cause harm. A vulnerability is what they exploit. Classical risk models multiply threat, vulnerability, and impact; ASSURED's RATM folds the threat and vulnerability questions into likelihood, so risk stays impact times likelihood. type: confirmed compromise via spearphishing attachment. Chain: T1566.001 → T1204.002 → T1059.001 → T1105 → T1071.001 → T1539 → T1550.004. Primary entities (confirmed): dlin ( User The identity behind activity on a system: the account that authenticated, launched the process, or received the email. In triage the user field names an account, not necessarily a person; whether the legitimate owner was actually behind the activity is exactly the question stolen credentials raise. ), laptop-finance-09 (host), dlin’s cloud SSO identity. All high confidence. Secondary entities (confirmed): one peer host also executed the payload (laptop-finance-12). Cloud finance platform shows federated login but no in-app activity yet. Intelligence Information gathered and analyzed to understand and predict potential security threats. context: the dropper hash matches a known campaign at medium confidence. The C2 Domain Either a DNS name like example.com that identifies internet infrastructure, or a Windows Active Directory domain, the identity and authentication boundary attackers aim to own; context makes the sense clear. As an indicator, a DNS domain's age, registrar, and reputation are among the first pivots in triage. is brand-new and does not match prior intel. Coverage gaps: cloud finance platform’s in-app activity is in vendor logs, request pending. Mobile-app activity on BYOD phones is invisible. Detection gaps: the rule that fired on host A did not fire on host B even though both ran the same payload. Cause: rule expects file path X; host B used path Y. Feature request opened. Open question for Risk: Is the current scope (3 primary + 1 peer + 1 SaaS) sufficient, or should Risk push back to Scope to widen to other finance-team mailboxes that may have received the same email?
The handoff is one screen of structured text. Every line points Risk at a specific decision. Nothing requires re-reading the SIEM query history.
Key Takeaway
Uncover’s deliverable is a narrative supported by evidence, with explicit confidence and explicit gaps. Risk’s job is to evaluate whether that deliverable is complete enough to act on. Done well, the decision (close, escalate, or rescope) is obvious from the handoff document alone. Done poorly, Risk has to redo Uncover’s work before it can decide.