Two incident reports can differ without either being wrong. Their authors may have examined different victims, samples, time windows, or stages of an investigation. A sound comparison preserves those boundaries. It also separates a technical observation from a product capability claim or a hypothesis about the broader campaign.
Preserve the publication record
Record the original publisher, title, publication date, update date if visible, retrieval date, and exact URL. Note whether the report is provisional, retrospective, or a product demonstration. Keep an authorized reference copy or citation record where appropriate. A page's current contents may include later corrections, so do not assume every sentence appeared on its original publication date.
Extract claims into a comparison table
Use one row per claim. Include its subject, scope, stated basis, certainty language, and relevant time window. Label direct telemetry, reverse-engineering result, external attribution, inference, and marketing statement separately. A publisher's observation on its customer estate should remain attributed to that visibility. Avoid translating it into an unqualified statement about every affected organization.
Compare like with like
Match sample identity, software version, victim environment, and campaign stage before treating statements as contradictory. “Observed in our data” and “possible from code analysis” answer different questions. A product detecting a behavior in a demonstration does not establish that it detected every occurrence during the historical incident. Keep protection assertions distinct from evidence of actual response outcomes.
Trace dependencies between publishers
Follow citations to the original analysis. If three reports repeat one publisher's finding, list that shared source instead of calling them three independent confirmations. Shared samples and shared telemetry can also reduce independence. When an underlying source cannot be inspected, state that the comparison relies on the available description. Do not fill missing methodology with assumptions about the author's reputation.
Resolve differences with explicit questions
For a meaningful discrepancy, state the observation that could distinguish explanations. A different sample might explain different behavior; a later update might revise an earlier inference. Record which answer the available material supports and which remains open. A comparison can conclude that public reporting is insufficient. That is a useful boundary, especially when the unavailable material concerns victim-specific evidence.
Apply the comparison to your own case carefully
Use published research to prioritize examination and to identify possible mechanisms. Establish local evidence separately. A matching filename, account pattern, or behavior may be a lead without proving campaign membership or actor identity. Explain the additional observations needed before strengthening the claim. Record the relevant publication version so a future reviewer can understand the information available at the time.
- Read the NotPetya case analysis
Follow the distinction between reported log clearing and a local absence claim.
- Read the SolarWinds case analysis
Separate signed content from the security of the production process.