Separate Incident Evidence from Reassurance

On 21 September, an attacker breached the ticketing environment of the Dutch Institute for Vulnerability Disclosure, DIVD. Its case file, updated on 9 October, attributes subsequent activity to AI agents. That is the organisation’s assessment of the intrusion, not independent proof of a fully autonomous attack. The case remained open at this review’s cutoff. ¹

DIVD’s separate data overview distinguishes investigation progress, preliminary findings and final assessment. It reports confirmed loss of email-address data, possible additional exposure and areas still being examined. It also warns that inclusion in its overview does not itself mean a data category was compromised. This is an account from the affected organisation, not a completed independent audit. ²

The supplier’s account matters too. Zammad’s 5 October advisory says one reported vulnerability is exploitable in older, unsupported versions but not in version 7 and later in practice. It describes the separate privilege-escalation issue as requiring prior server access and says a solution is being worked on. These distinctions do not support a blanket claim that every version has the same remote exposure or that all issues are resolved. ³

The condition leaders should address is the gap between a technical observation and the business conclusion drawn from it. Finding no matching records can mean nothing happened. It can also mean the records do not cover the right system, period or activity. A reassuring sentence can erase that distinction before anyone has deliberately decided to accept the remaining uncertainty.

That is the Institute’s interpretation, not a finding that DIVD concealed information. Its public separation of investigation stages illustrates a useful alternative. A board should ask what supports a negative finding and what the investigation could not observe. It should not require investigators to prove an impossible universal negative before taking sensible protective action.

New alert-triage research points in the same direction. A preprint testing 1,247 alerts from one multi-stage attack scenario found that unsuccessful evidence searches could contribute to missed attacks. Its proposed review method improved results in that benchmark. This is a controlled study, not a measured failure rate for commercial security teams, and it does not independently explain the DIVD breach. ⁴

Start with the claims that change someone’s behaviour: whether credentials need replacing, whether a service can reopen, whether customers should take precautions, and whether a notification is required. Attach a source, time window and accountable owner to each. Distinguish information that was reachable from information demonstrably accessed, copied or altered.

Use three plain states: confirmed impact, unresolved exposure, and no signs found within a stated investigation scope. The last is not a guarantee. Record the material gaps beside it, including unavailable supplier records or short retention periods. Ask the incident lead to explain what additional evidence would change the assessment and when the next update is due.

Give communications and customer-support teams the same approved account, with wording suitable for the people affected. Do not let one team promise safety while another is still assessing the same information. Restrict sensitive investigation details to those who need them; transparency does not require publishing exploitable weaknesses or personal information.

If an AI assistant helps draft the update, require a person to check every material statement against the evidence register. Fluent wording can make an unresolved claim sound settled. The accountable incident lead should approve the meaning, not simply the tone.

The evidence discipline works across borders, but a single global notification rule does not. The UK Information Commissioner’s guidance explicitly accommodates an initial report followed by further information. It also flags that its guidance is under review. Leaders should use current advice for the affected entity and people, rather than copy a deadline from an overseas case. ⁵

Singapore’s data-protection authority provides a separate framework covering notification criteria, timing and required information. Its guidance should be assessed on its own terms, not treated as equivalent to the UK process. This note does not determine whether a particular incident is legally notifiable. ⁶

For North American, European, Asia-Pacific, African, Middle Eastern and Latin American operations, identify the applicable legal and contractual duties with local specialists. Also test practical capacity: can the organisation obtain supplier records, preserve evidence and communicate in the languages people use? This review provides no comparable regional incident-rate data. A resource-constrained team may need external response support; a multinational may need several local notification decisions from one shared factual record.

Run a short exercise using one plausible breach. Give the team incomplete evidence and ask for the first executive update, the protective actions and the next scheduled revision. Include the incident lead, a business owner, privacy or legal support, and customer communications. Look for statements that become more confident as they move between teams.

Success is not a polished declaration that everything is safe. It is a defensible account of what is known, what still needs checking and who will act. That is a more useful basis for trust than certainty delivered before the evidence.