KNOWN VS UNKNOWN
Editorial boundary before the final forensic report
KNOWN
• models and benchmark family
• production classifiers disabled
• proxy zero-day and Internet access
• privilege escalation and HF access
UNKNOWN
• complete timeline and dwell time
• exact vulnerabilities and IoCs
• precise records accessed
• final root-cause allocation