Product guidance ยท September 23, 2026
A query returning no rows is a result of execution. A conclusion that no malicious activity was observed requires more: a defined hypothesis, a stated time window, suitable telemetry, completed analytical checks and an explicit human assessment.
Keep three questions separate
First, did the work execute successfully? Second, was the evidence sufficient for the proposed conclusion? Third, what does the analyst assess? Threat Foundry preserves execution, evidence completeness and reviewed security assessment as separate dimensions.
A completed query can still have a truncated result, unresolved asset identities or missing telemetry. A saved plan is not performed work. Neither should quietly become a clean-environment statement.
Record what the analyst actually did
Record performed checks against the exact evidence receipt and distinguish them from planned, skipped, unavailable or failed steps. A suggested pivot belongs in proposed follow-up until it has been performed and supported by a reference.
Customer wording should explain the strategy and relevant evidence without exposing proprietary queries or internal notes. Where a required check could not be completed, the limitation belongs alongside the conclusion.
Choose the assessment the evidence supports
The four reviewed outcomes are confirmed malicious activity, suspicious or inconclusive activity, no malicious activity observed, and insufficient telemetry. Row counts do not select the assessment.
A negative assessment is scoped to completed checks, a valid time window and suitable validated telemetry. It does not promise universal coverage, future safety or the impossibility of compromise. If limitations prevent that conclusion, state them and identify the work needed next.
Publish the exact reviewed account
Review the assessment, inspect the customer projection and authorize publication of that exact version. Historical publication facts remain fixed even when the hunt, asset inventory or source intelligence changes later. A new publication advances the customer channel while retaining earlier versions.
The customer portal and supported operator-generated PDF, Word and PowerPoint deliverables use the same pinned publication facts. That makes the report easier to explain when a customer asks what was assessed and why the conclusion was justified.