What 'We Would Know' Requires: Logging Questions for the Board

In every board discussion of a competitor's breach, someone says the reassuring sentence: we would know if that happened here. It is said with confidence and almost never examined. Whether it is true depends on decisions about what is logged, how long it is kept, and who looks at it, and those decisions were made years ago by people optimizing for cost.

Logging is unglamorous, which is why it escapes oversight. It is also the foundation of every incident answer: what happened, when it started, what was taken. The industry habit of discovering breaches months late is, at root, a logging and reviewing failure.

Directors do not need to understand log formats. They need to ask five questions and recognize a real answer.

TLDR

• 'We would know' is a claim about logging coverage, retention, and review. Ask about all three.

• Coverage: are the crown-jewel systems and key accounts actually logging to a central place?

• Retention: how far back could an investigation look, and is that long enough?

• Review: whose job is it to look, and what did they find last quarter?

• The proof is a past investigation that used the logs successfully.

Coverage: what is actually being recorded

The first question is whether the important systems send their logs anywhere at all. Ask for the short list: do the crown-jewel applications, the identity system, the email platform, and the key vendors log to a central store?

The answer is usually partial. The main ERP logs; the marketing platform with the customer database does not. Coverage gaps are normal, but they should be known gaps with names, not surprises discovered during an incident.

The discipline behind a one-page cyber dashboard applies here too: a short list of covered and uncovered critical systems beats a wall of metrics.

Retention: how far back can we look

The second question is time. When investigators reconstruct an intrusion, they typically need to look back months. If logs roll over after thirty days, the answer to 'when did this start' will be 'before our records begin.'

This fictional example shows a retention summary a board might see. It is an illustration, not a prescription.

Source	Kept	Investigation reach
Identity and email sign-ins	12 months	Full year
Core business applications	6 months	Two quarters
Network perimeter	90 days	One quarter
SaaS marketing platform	Not collected	None

The right retention is a cost decision, and it belongs in front of executives with the trade-off stated plainly: this is how far back we could investigate, and this is what looking further costs.

Review: who is actually looking

Logs that nobody reviews are a write-only memory. The third question is who looks, at what, with what result. Whether it is an internal analyst, a provider, or a tool with a human behind the alerts, someone should be able to narrate the last three things they investigated.

A quiet quarter is not proof of safety; it is often proof of silence. The test that separates the two is whether the reviewer can show you what they chased and closed. The discussion of what changes when evidence contradicts the green dashboard is the same lesson from the reporting side.

The proof question

The strongest evidence that 'we would know' is a time you did. Ask: in the last year, what did the logs help us catch or rule out? A real example, even a small one, demonstrates the whole chain: coverage captured it, retention kept it, review surfaced it.

If the honest answer is that the logs have never been used, the assumption deserves a test. A small purple-team exercise or a review of one past anomaly will say more than another assurance.

The related discussion of one-page cyber dashboard is worth your time alongside this one. The related discussion of evidence contradicts the green dashboard is worth your time alongside this one.

Frequently asked questions

Is this not too technical for a board?

The questions are not technical: what is recorded, how long is it kept, who looks at it, and when did it last prove useful. Directors judge the answers the way they judge audit evidence.

How much should logging cost?

There is no benchmark that fits all, but the cost driver is volume and retention. The board's role is to make the trade-off explicit rather than let it be made silently by default settings.

We use a provider for monitoring. Is that enough?

Only if you ask the provider these same questions. Outsourced review of incomplete logs is still incomplete. The contract should state coverage and retention, and the quarterly review should test them.

A Defensible Next Step

At the next cyber update, ask the four-part question: what do we log, how long do we keep it, who reviews it, and what did it last catch? The quality of the answer tells you whether 'we would know' is a capability or a hope. Book a Decision-Clarity Call if you want help framing the review.