Coverage gaps
Systems and asset groups that never produced telemetry, often servers, OT segments, or recently migrated infrastructure.
Concept & methodology
What is a Forensic Horizon?
The maximum historical period for which your organization can reliably reconstruct a cyber incident using available security evidence.
Why the longest retention setting is misleading
Retention is usually reported per system. Investigations do not work per system. A single question, such as when the attacker first gained access and from where, normally requires several sources at once: perimeter records to establish the connection, identity records to establish the account, endpoint detail to establish what executed, and name-resolution records to attribute an address to a host.
If any one of those sources no longer holds data for the period in question, the chain breaks. The investigation does not degrade gracefully; specific conclusions simply stop being defensible.
A worked example
Consider an organization with the following retention configuration.
| Evidence source | Configured retention | Typical investigative use |
|---|---|---|
| Firewall | 180 days | External connections, egress volume |
| VPN | 365 days | Remote access sessions, source addresses |
| Active Directory | 90 days | Authentication, group changes, directory access |
| EDR | 30 days | Process execution, command lines, file activity |
| DNS | 14 days | Name resolution, host attribution, C2 lookups |
On paper this environment holds up to a year of evidence. In practice, reconstructing a ransomware intrusion requires endpoint process detail to establish execution and persistence, and name-resolution records to attribute internal addresses to hosts. Endpoint detail stops at 30 days, and DNS at 14. Beyond roughly 30 days, the organization can still describe that traffic occurred, but not reliably establish which host, which process, or which user was responsible.
The effective investigative capability, the Forensic Horizon, is therefore approximately 30 days, not 365.
Evidence-source dependency
Each investigative question has a dependency set. Some sources are load-bearing: their absence removes the answer entirely. Others are corroborating: their absence reduces confidence but leaves a defensible conclusion. Measuring a Forensic Horizon means recording those dependencies explicitly, then testing whether each source actually returns usable data for the period claimed.
Horizons are scenario-specific
There is no single number for an organization. A Microsoft 365 account compromise may be reconstructable for 90 days because it depends primarily on identity and mailbox audit records. A data exfiltration case involving an internal workstation may fail after two weeks because it depends on name resolution and endpoint file activity. Each scenario carries its own horizon, and the shortest ones are usually the ones that matter most.
Evidence retention by source
Example AssessmentVPN365d
Firewall180d
Active Directory90d
EDR30d
DHCP30d
DNS14d
Current Forensic Horizon
30 days
Determined by the shortest retention among the evidence sources an investigation actually requires, not by the longest retention configured.
How it is calculated
- 01Select the threat scenarios relevant to the environment.
- 02Decompose each scenario into the investigative questions responders must answer.
- 03Record the evidence sources each question depends upon.
- 04Establish real retention, coverage, accessibility and quality per source.
- 05Validate availability technically rather than accepting configuration claims.
- 06Determine the point in the past at which load-bearing evidence stops being usable.
Constraints
What limits a Forensic Horizon in practice
Short retention on detail sources
Endpoint and name-resolution records are usually the highest-volume and shortest-retained, and also the most attribution-critical.
Inaccessible archives
Evidence that technically exists but cannot be searched within an investigation timeline.
Reduced field fidelity
Filtered or truncated events that satisfy a detection rule but cannot support a reconstruction.
Silent collection failure
Collectors, agents and forwarders that stopped delivering without raising an operational alert.
Unvalidated assumptions
Capability recorded from policy documents rather than tested against historical data.
Why long-dwell intrusions expose the problem
Intrusions involving credential theft, persistence and staged exfiltration are typically discovered well after initial access. By the time the investigation begins, the earliest and most decisive activity sits outside the retention window of the detail sources needed to explain it. The organization can confirm that an incident occurred, but cannot establish its origin, scope or whether data left the environment.
That is the gap a Forensic Horizon measurement is designed to expose in advance, while retention, coverage and configuration can still be changed.
Measurement chain
- 01Threat Scenario
- 02Investigative Question
- 03Evidence Requirement
- 04Available Evidence
- 05Reconstruction Capability
Measure how far back you can investigate, then extend it.
An assessment establishes the baseline, validates it technically, and identifies the changes that extend it.