The most underrated investigation skill: explaining what you found to people who need different things from it.
Same case. Same evidence. Four audiences:
- The customer wants to know: was I attacked, and what do I do right now?
- Leadership wants: how bad is it, what does it cost, what's the fix?
- R&D wants: exact repro steps, logs, and artifacts
- The next analyst wants: a record clear enough that they don't redo your work
Give leadership a stack trace and you lose them. Give R&D a vibe and the bug never gets fixed.
A finding nobody acts on isn't really finished. Translation is part of the investigation.