A report is read by people looking for a reason to discount it. Separating what you established from what you inferred, explicitly, is what prevents one weak claim from devaluing the rest.
Three kinds of statement
| Kind | Example from this estate | How to write it |
|---|---|---|
| Established | cv-industrial.com returns SERVFAIL from 1.1.1.1 with the ad flag absent, checked at a stated time | State it flatly, with the query and the answer. |
| Inferred, well-supported | Five lookalike domains are under common control | Name the inference and the evidence: shared nameservers, issuance within one day. |
| Inferred, weakly | The campaign was prompted by the absence of an enforcing DMARC policy | Say it is a hypothesis, or leave it out. It is not evidenced. |
| Unknown | Whether any customer has entered credentials on the live phishing page | State that it is unknowable from this evidence, and say why. |
The claims to resist
- Customer harm you cannot evidence. Aggregate reports carry no recipients, and nothing in a domain assessment sees a victim.
- Attribution. “A sophisticated actor” is unsupported by shared nameservers and a favicon hash.
- Causation between findings. The lookalikes and the
p=nonerecord are both true; one causing the other is a story. - Financial impact estimates. Unless finance supplied the numbers, they are yours to defend and you cannot.
Writing the unknowns down
UNKNOWN, AND WHY Whether the .de and .co.uk domains are locked The registrar is not known internally. RDAP shows a reseller. Resolving this is item 3 in the 30-day plan. Whether mail has been received by the two parked domains with MX No reporting has ever been configured on them. Publishing rua answers it in a fortnight. Whether the 2024 CNAME target is claimable Requires checking the provider's name-registration policy. Assume claimable until established otherwise.
The unknowns section is a work list
Each one has an action that resolves it, and most of those actions are free. Written this way, the unknowns are not an admission of incompleteness — they are the first three items of the plan, with the reason each is worth doing already stated.