Conversation

Successful analysts must learn to distinguish between two thoughts:

“This investigation is difficult.”

“This investigation is going nowhere.”

The first describes the work. The second is a judgment about its prospects.

Research suggests that when we interpret difficulty as a sign of importance, we’re more likely to persist. When we interpret it as a sign of impossibility, we’re more likely to disengage.

A difficult investigation isn’t necessarily a dead end. Sometimes the difficulty is a signal that the problem deserves more attention, not less. How you interpret difficulty shapes how you invest our time and effort.

#SOC #InvestigationTheory #DFIR