3. Evidence-Based Practice and Applied Research Methods

Introduction and Context

Cybersecurity decisions are often made under conditions of uncertainty. Security leaders must decide whether to patch a vulnerability immediately, replace a security control, investigate an anomaly, change access policies, or accept a risk. These decisions may involve incomplete telemetry, conflicting stakeholder interests, limited budgets, and rapidly changing threats. Experience and professional judgement remain important, but they are not sufficient on their own. Effective practice requires defensible evidence.

Evidence-based cybersecurity practice is the disciplined use of relevant, credible, and systematically analysed information to guide decisions. Evidence may come from peer-reviewed research, incident records, threat intelligence, vulnerability data, control assessments, interviews, experiments, or operational metrics. Applied research methods provide the means to collect, evaluate, and interpret that evidence. They help practitioners distinguish a genuine pattern from an isolated event, a causal relationship from a correlation, and a measured improvement from an assumed one.

This chapter develops a research-oriented approach to cybersecurity practice. It considers literature reviews, case analysis, threat intelligence, qualitative and quantitative methods, hypothesis development, validity, reproducibility, ethics, and the translation of findings into organisational decisions. The emphasis is not on research for its own sake. It is on producing evidence that is sufficiently trustworthy, transparent, and relevant to support action.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain the meaning and importance of evidence-based cybersecurity practice.

2. Formulate focused research questions and testable hypotheses.

3. Conduct a structured literature review and evaluate source quality.

4. Distinguish qualitative, quantitative, and mixed-methods approaches.

5. Analyse case evidence and threat intelligence without overstating conclusions.

6. Assess reliability, validity, bias, uncertainty, and limitations.

7. Design a reproducible cybersecurity investigation or evaluation.

8. Apply ethical, legal, governance, and professional principles to research.

9. Translate research findings into technical, managerial, and strategic decisions.

Evidence as a Foundation for Cybersecurity Decisions

Evidence is information that has been collected or documented in a manner that permits its relevance and credibility to be assessed. A firewall alert, for example, is evidence that a rule was triggered; it is not automatically evidence of a successful attack. Similarly, a reduction in reported incidents after security training does not necessarily demonstrate that training caused the reduction. Reporting behaviour, staffing levels, detection coverage, and changes in attacker activity may also have changed.

Evidence-based practice therefore involves more than gathering data. It requires a chain of reasoning:

• a clearly defined decision or problem;
• a question that can be investigated;
• an appropriate method of collecting evidence;
• critical assessment of quality and limitations;
• analysis that is proportionate to the data; and
• a decision that explicitly recognises uncertainty.

A useful distinction is between data, information, evidence, and knowledge. Data are recorded observations, such as authentication events or survey responses. Information is data organised in a meaningful context. Evidence is information judged relevant to a question and supported by a defensible method. Knowledge is an interpreted understanding that can inform future action. Confusing these levels can lead to overconfident security decisions.

Cybersecurity evidence also has different forms. Technical evidence includes logs, malware samples, vulnerability scans, configuration states, and network flows. Organisational evidence includes policies, audit findings, staffing records, incident timelines, and budget information. Human evidence includes interviews, observations, survey responses, and reports from analysts or users. External evidence includes threat reports, standards, academic studies, regulatory guidance, and information-sharing communities. No single form is universally superior; its value depends on the question being asked.

From Practice Problem to Researchable Question

Applied research begins with a problem rather than a method. “Our organisation has too many phishing incidents” is a practical concern, but it is not yet a precise research question. It may be refined into: “Among employees in high-risk roles, does simulated phishing training combined with immediate feedback reduce repeat click rates over six months compared with training alone?” The refined question identifies a population, intervention, outcome, comparison, and period.

The PICOT structure can assist with applied questions:

• Population: Who or what is being studied?
• Intervention or exposure: What control, condition, or activity is relevant?
• Comparison: What alternative or baseline is used?
• Outcome: What measurable or observable result matters?
• Time: Over what period will the outcome be assessed?

Not every cybersecurity question requires all five elements, but the structure exposes ambiguity. A research question should also be feasible, ethically acceptable, significant to practice, and answerable with available resources.

A hypothesis is a provisional, testable statement about a relationship or difference. For example: “After controlling for business unit and baseline click rate, monthly phishing simulations with targeted feedback will reduce repeat click rates more than annual awareness training alone.” A null hypothesis would state that no such difference exists. Hypotheses should specify variables and direction where justified. They should not be written after results are known merely to make an unexpected finding appear predicted; that practice is known as HARKing, or hypothesising after the results are known.

Variables may be independent, dependent, control, mediating, or confounding. In the phishing example, the training intervention is the independent variable, repeat click rate is the dependent variable, and business unit may be a control variable. A confounder is a factor related to both the intervention and the outcome that can create a misleading association. Employees receiving enhanced training may already work in units with stronger security leadership; leadership, rather than training alone, may explain part of the improvement.

Reading the Literature Critically

A literature review is a structured synthesis of existing knowledge, not a sequence of article summaries. Its purpose is to identify what is known, how it has been studied, where findings agree or conflict, and what gap the proposed investigation addresses.

A rigorous review normally begins with a review question and a search strategy. Relevant databases may include academic indexing services, digital libraries, standards repositories, government publications, and authoritative industry sources. Search terms should reflect synonyms, technical vocabulary, and alternative spellings. Search decisions, dates, databases, inclusion criteria, and exclusion criteria should be recorded so that another researcher could understand how the evidence base was assembled.

Sources should be assessed for authority, methodological quality, relevance, currency, transparency, and possible conflicts of interest. A peer-reviewed article is not automatically reliable, and an industry report is not automatically invalid. The reader should ask whether the research design fits the claim, whether the sample is appropriate, whether measures are defined, whether limitations are disclosed, and whether conclusions exceed the data.

A synthesis may be organised thematically, chronologically, methodologically, or by competing explanations. A useful evidence matrix records the source, research question, context, population, method, principal findings, limitations, and relevance to the current problem. Systematic reviews may use explicit protocols and screening procedures. Scoping reviews are useful when a field is broad or conceptually immature. Rapid reviews provide timely but often less comprehensive syntheses for operational decisions.

Literature reviews in cybersecurity face particular difficulties. Terminology changes quickly; vendor reports may use inconsistent definitions; sensitive incidents may be underreported; and operational findings may not be published. Researchers should distinguish between an absence of evidence and evidence of absence. If few studies examine a control, this does not prove that the control is ineffective.

Qualitative, Quantitative, and Mixed Methods

Quantitative research represents phenomena numerically. It is suitable for estimating frequency, comparing groups, measuring change, modelling relationships, and testing hypotheses. Common designs include cross-sectional surveys, longitudinal studies, experiments, quasi-experiments, and statistical analysis of operational data.

Descriptive statistics summarise observations through counts, proportions, means, medians, dispersion, and rates. Inferential statistics estimate how likely an observed pattern would be under specified assumptions. Correlation measures association, whereas regression can model the relationship between an outcome and several predictors. Statistical significance should not be confused with practical significance: a very small improvement may be statistically detectable in a large dataset but operationally unimportant.

Measurement quality is central. “Security maturity,” “alert fatigue,” or “resilience” must be operationalised into observable indicators. Reliability concerns consistency of a measure. Validity concerns whether the measure represents the intended construct. A log-based metric may be highly reliable but have weak validity if logging coverage is incomplete.

Qualitative research examines meaning, experience, process, and context. It is valuable when the researcher needs to understand why analysts bypass a control, how incident decisions are made, or how organisational culture shapes reporting. Interviews, focus groups, observations, document analysis, and incident narratives are common methods. Sampling is often purposive rather than random, selecting participants with relevant experience.

Qualitative analysis may involve coding transcripts, identifying categories, comparing cases, and developing themes. Credibility can be strengthened through triangulation, member reflection, peer debriefing, a documented audit trail, and reflexivity. Reflexivity requires the researcher to consider how professional role, assumptions, or relationship with participants may influence the study.

Mixed-methods research combines quantitative and qualitative evidence. For example, a survey may establish that analysts experience high alert fatigue, while interviews explain how queue design, escalation rules, and staffing produce that experience. In a sequential explanatory design, quantitative results are collected first and qualitative work is used to explain them. In a sequential exploratory design, qualitative findings help develop a later instrument or hypothesis. Mixed methods require genuine integration; simply placing two unrelated studies side by side is not sufficient.

Case Analysis and Threat Intelligence as Applied Evidence

Case analysis examines a bounded incident, organisation, technology, or decision over a defined period. It is especially useful for complex cybersecurity events in which technical, human, and governance factors interact. A case should be constructed from multiple sources where possible: logs, tickets, interviews, timelines, policies, forensic findings, and external intelligence.

A disciplined case analysis separates facts, interpretations, and assumptions. Facts are directly supported observations, such as a timestamped authentication event. An interpretation might be that the event indicates credential compromise. An assumption might be that the account owner was the actor. The distinction prevents a plausible narrative from being mistaken for proof.

Threat intelligence is evidence about adversaries, capabilities, infrastructure, motivations, tactics, techniques, procedures, and likely effects. Strategic intelligence supports executive planning; operational intelligence supports campaign understanding; tactical intelligence informs defensive engineering; and technical intelligence includes indicators such as domains, hashes, and IP addresses. Intelligence has value only when it is relevant, timely, sufficiently reliable, and connected to a decision.

Indicators of compromise should not be treated as permanent truth. An IP address may be shared or reassigned, a hash may change after minor malware modification, and a domain may be benign at one time and malicious at another. Intelligence analysis should record source reliability, information credibility, collection time, confidence level, and corroboration. A useful confidence statement distinguishes “confirmed,” “high confidence,” “moderate confidence,” and “uncertain,” while explaining the basis for the judgement.

The intelligence cycle—direction, collection, processing, analysis, dissemination, and feedback—illustrates that intelligence is decision-oriented. A threat report that is never mapped to assets, controls, or actions is information rather than effective intelligence. Structured analytic techniques, such as analysis of competing hypotheses, can reduce confirmation bias by requiring analysts to test multiple explanations against the available evidence.

Designing Credible Studies

Research design should follow the question. An experiment provides stronger control over causal inference when participants or systems can be assigned to conditions ethically and practically. In cybersecurity, randomisation may be possible for training interventions or interface designs but inappropriate for deliberately exposing production systems to attack. Quasi-experimental designs, such as interrupted time series or difference-in-differences comparisons, may be more realistic.

A cross-sectional study captures a situation at one point in time and is useful for prevalence or perception questions, but it is weak for establishing temporal order. Longitudinal research follows observations over time and can examine trends, persistence, and delayed effects. Case-control designs compare cases with and without an outcome and can be useful for investigating rare events, although selection and recall bias require care.

Sampling determines what conclusions can reasonably be drawn. Probability sampling supports statistical generalisation when a suitable sampling frame exists. Convenience sampling is easier but may systematically exclude relevant groups. In qualitative research, sampling may continue until additional data provide limited new insight, often described as saturation, although saturation should be justified rather than asserted.

A study protocol should specify the question, hypotheses, population, variables, procedures, analysis plan, data management, ethical safeguards, and limitations before data collection. Pre-registration, where suitable, records planned hypotheses and analyses and reduces selective reporting. It does not prevent legitimate exploratory analysis, but exploratory findings should be labelled as such.

Reproducibility means that another competent researcher can follow the documented procedures and obtain the same or sufficiently comparable results using the same data and code. Replicability is often used for obtaining consistent findings in a new study or environment. In operational cybersecurity, exact replication may be impossible because environments change, but procedural transparency remains achievable.

Reproducible practice may include version-controlled code, a data dictionary, immutable timestamps, documented transformations, configuration files, dependency specifications, test datasets, cryptographic hashes, and a clear chain of custody. Sensitive data should be minimised, de-identified, access-controlled, and retained only as long as justified. Reproducibility does not require publishing confidential logs; it may involve sharing synthetic data, aggregate results, analysis scripts, or a secure review process.

Interpreting Results Without Overclaiming

A result must be interpreted in relation to its design and uncertainty. An association does not establish causation. Causal claims require temporal order, plausible mechanisms, consideration of alternative explanations, and an appropriate design. Confidence intervals communicate estimation uncertainty more informatively than a binary significant/non-significant label. Effect size indicates practical magnitude, while statistical significance is influenced by sample size and variability.

Researchers should report missing data, excluded observations, failed measurements, and deviations from the protocol. Selective reporting can produce an overly favourable picture of a control. Multiple comparisons also increase the probability of apparently significant findings by chance; analysis plans and appropriate correction procedures help manage this risk.

External validity concerns whether findings apply beyond the study context. A security awareness intervention tested in a technology company may not work identically in a hospital or public agency. Transferability depends on similarity of people, technology, threat environment, organisational culture, and implementation conditions. Rather than claiming universal effectiveness, practitioners should state the conditions under which a finding is likely to apply.

Decision-makers should use an evidence hierarchy cautiously. Controlled studies may support causal claims, while well-documented case evidence may provide rich contextual insight. Expert judgement is valuable when evidence is scarce, but it should be made explicit, structured, and open to challenge. A practical decision can combine evidence strength, expected benefit, cost, reversibility, legal exposure, and consequences of delay.

Illustrative Case: Evaluating an Endpoint Detection Improvement

Background

This illustrative case concerns Northbridge Services, a fictional organisation with approximately 2,000 employees. Its security operations centre receives alerts from endpoint detection and response software, a security information and event management platform, and identity systems. Analysts report that the alert queue is growing and that high-priority incidents are sometimes identified late.

Situation and Problem

Management proposes purchasing an advanced analytics module. The vendor claims that the module will reduce mean time to detect and improve analyst productivity. The security manager must decide whether to approve the purchase, but current metrics are inconsistent. Different teams define “detection time” differently, and some endpoints have incomplete telemetry.

Analysis

The team first develops a research question: “Among endpoints with comparable telemetry coverage, does the analytics module reduce median time from malicious activity initiation to analyst escalation over a twelve-week period?” The primary outcome is median detection-to-escalation time. Secondary outcomes include false-positive rate, analyst workload, and confirmed incidents. The team identifies possible confounders, including staffing changes, major threat campaigns, tuning of existing rules, and differences between endpoint groups.

A baseline period is established. The team documents data sources, excludes systems without minimum telemetry coverage, and creates a data dictionary. Because random assignment is not feasible for all production endpoints, comparable business units are assigned to intervention and comparison groups where operationally acceptable. Analysts are trained on the new module, and the training period is recorded.

Quantitative analysis compares outcomes before and after deployment and between groups. Interviews with analysts explore whether the module changes triage behaviour, creates new forms of alert fatigue, or shifts work from detection to validation. The team also reviews a sample of incidents to determine whether shorter recorded times reflect genuine earlier discovery or merely a change in timestamp definitions.

Approach and Strategy

The evaluation uses mixed methods and a pre-specified analysis plan. Results are reported with effect sizes and uncertainty rather than only percentages. A governance review checks whether endpoint data include personal information and confirms that access is limited to authorised investigators. The team records module configuration, software versions, rule changes, and interruptions.

Outcome

The evaluation finds a moderate reduction in median escalation time for endpoints with complete telemetry, but little improvement for remote systems with intermittent connectivity. Analysts report that the module reduces repetitive correlation work but initially increases validation effort. Management approves a limited expansion focused on well-instrumented systems and funds improvements to remote telemetry rather than claiming universal success.

Learning Points

The case demonstrates that a vendor claim is not a local result. Clear definitions, a comparison condition, attention to confounders, mixed methods, and transparent limitations produce a more useful decision. It also shows that an intervention can improve one part of a process while creating workload elsewhere. Evidence-based practice does not always produce a simple yes-or-no answer; it can identify where, for whom, and under what conditions a control is worthwhile.

Ethical, Legal, and Governance Considerations

Cybersecurity research frequently involves sensitive information: personal data, employee behaviour, credentials, vulnerabilities, incident details, or evidence of criminal activity. Ethical review should consider informed consent where appropriate, proportionality, privacy, risk of harm, power relationships, and the public interest. Monitoring employees without clear notice or legitimate purpose may damage trust even when technically lawful.

Researchers must comply with applicable data protection, computer misuse, intellectual property, records management, and sector-specific requirements. Data minimisation means collecting only what is necessary. Pseudonymisation reduces direct identification but does not make data anonymous if re-identification remains possible. Vulnerability research requires responsible disclosure, controlled testing, and safeguards against enabling misuse.

Governance should define who owns the data, who may access it, how evidence is preserved, how conflicts of interest are declared, and how findings are approved for dissemination. Researchers should not suppress inconvenient findings because they threaten a project or vendor relationship. Professional integrity requires accurate reporting of uncertainty and limitations.

Common Failure Modes and Practical Safeguards

Several recurring mistakes weaken cybersecurity research. Starting with a preferred technology rather than a question creates confirmation bias. Treating vendor material as independent validation confuses advocacy with evidence. Using an unvalidated metric produces false precision. Inferring causation from a before-and-after comparison ignores other changes occurring at the same time. Removing inconvenient observations without documenting the reason creates selective reporting.

Other failures are operational. Logs may lack synchronised clocks, making incident timelines unreliable. Data may be silently altered during extraction. Threat intelligence may be copied into controls without checking relevance or expiry. Interviews may be conducted only with senior staff, excluding the analysts and users who experience the process directly. Finally, researchers may publish sensitive details that increase organisational or public risk.

Safeguards include an explicit protocol, independent review, source triangulation, data-quality checks, version control, documented assumptions, negative-case analysis, peer challenge, and a final statement of limitations. A decision log should connect each recommendation to evidence, confidence, cost, and residual risk.

Technology, Automation, and Emerging Practice

Modern security research increasingly uses data platforms, notebooks, statistical software, visual analytics, and machine learning. Automation can classify alerts, enrich indicators, detect anomalies, and reproduce routine analyses. However, automation may amplify biased training data, obscure decision logic, or produce confident but incorrect outputs. Human review remains necessary for high-impact decisions.

Generative AI can assist with literature discovery, coding drafts, interview summarisation, and analytic brainstorming, but its outputs require verification. Sensitive logs, proprietary intelligence, or personal information should not be submitted to unapproved services. Researchers should record when AI tools were used, validate generated citations and code, and retain responsibility for the final analysis.

Emerging practice is moving toward continuous control validation, privacy-preserving analytics, secure research environments, attack-path modelling, and machine-readable evidence. These developments increase analytical capability but also make provenance, model governance, and explainability more important. The central principle remains unchanged: technology can accelerate evidence production, but it cannot replace sound questions and critical judgement.

Best Practices for Evidence-Based Cybersecurity Work

A mature practitioner should:

1. Begin with a decision and define what evidence would change it.

2. Use precise questions, operational definitions, and justified hypotheses.

3. Combine internal data with relevant external research and intelligence.

4. Match the method to the question rather than forcing a preferred method.

5. Check data quality, measurement validity, bias, and uncertainty.

6. Separate observed facts from interpretation and judgement.

7. Pre-specify important analyses and document deviations.

8. Use triangulation when no single source is complete.

9. Protect privacy, preserve evidence integrity, and apply responsible disclosure.

10. Report negative findings and limitations honestly.

11. Make results reproducible to the greatest extent security and confidentiality permit.

12. Translate findings into actions, owners, measures, timelines, and residual-risk decisions.

Chapter Summary

Evidence-based cybersecurity practice connects a defined decision with credible, systematically analysed information. Applied research begins by refining a practical problem into a researchable question and, where appropriate, a testable hypothesis. Literature reviews establish what is already known, while case analysis and threat intelligence provide contextual and operational evidence. Quantitative methods measure patterns and relationships; qualitative methods explain experience, process, and meaning; mixed methods integrate both.

Credible studies require appropriate design, valid measures, careful sampling, attention to confounding, transparent analysis, and honest treatment of uncertainty. Reproducibility depends on documented procedures, data governance, version control, and preserved provenance. Ethical and legal safeguards are essential because cybersecurity evidence often contains sensitive personal, technical, or organisational information. The practical goal is not certainty in every decision but a defensible basis for action, including a clear understanding of assumptions, limitations, and residual risk.

Key Terms

Evidence-based practice: Using systematically assessed evidence to guide professional decisions.

Applied research: Investigation designed to solve a practical problem or improve practice.

Research question: A focused, answerable statement defining what an investigation seeks to understand.

Hypothesis: A testable proposition about an expected relationship or difference.

Operationalisation: Defining an abstract concept through measurable or observable indicators.

Confounder: A factor associated with both an exposure and an outcome that may distort their apparent relationship.

Validity: The extent to which a measure or study supports the intended interpretation.

Reliability: The consistency of a measurement or procedure.

Literature review: A structured synthesis and critical evaluation of existing knowledge.

Triangulation: Using multiple sources, methods, or investigators to strengthen interpretation.

Qualitative research: Research examining meaning, experience, context, or process, commonly through textual or observational data.

Quantitative research: Research representing observations numerically for measurement, comparison, or statistical analysis.

Mixed methods: Integration of qualitative and quantitative approaches in one investigation.

Threat intelligence: Analysed information about threats that supports security decisions.

Reproducibility: The ability to repeat documented procedures and obtain comparable results using the same materials.

Replicability: The ability to obtain consistent findings in a new study or context.

External validity: The extent to which findings can reasonably apply beyond the study setting.

Researcher reflexivity: Critical examination of how the researcher’s position and assumptions influence the study.

Selective reporting: Presenting only favourable or convenient analyses or findings.

Review Questions

Short Answer Questions

1. Distinguish between data, information, evidence, and knowledge in a cybersecurity investigation.

2. What are the five elements of the PICOT structure?

3. Explain the difference between reliability and validity.

4. Why should a threat intelligence report include confidence and source-reliability information?

5. What is meant by reproducibility in applied cybersecurity research?

Long Answer Questions

1. Explain how a practical cybersecurity concern can be transformed into a focused research question and testable hypothesis.

2. Describe the process of conducting a critical literature review for a cybersecurity control evaluation.

3. Compare qualitative, quantitative, and mixed-methods research, including the types of cybersecurity questions suited to each.

4. Discuss how confounding, measurement quality, and external validity affect interpretation of cybersecurity findings.

5. Explain the ethical, legal, and governance issues involved in researching employee behaviour and security telemetry.

Analytical / Application Questions

1. An organisation reports a 40 per cent fall in incidents after introducing mandatory awareness training. Design an evaluation that would determine whether the training caused the reduction.

2. A threat report identifies an IP address associated with malicious activity, but the address is also used by a cloud provider. Explain how you would assess the evidence before blocking it.

3. A security analytics tool reduces alert volume but analysts report more time spent validating alerts. Propose a mixed-methods study and identify the outcomes, confounders, and limitations you would examine.

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes evidence from raw cybersecurity data?

A. Evidence is any information stored in a security platform

B. Evidence is information judged relevant to a question and supported by a defensible method

C. Evidence is always numerical and statistically significant

D. Evidence is information obtained only from peer-reviewed journals

Correct Answer: B. Evidence is information judged relevant to a question and supported by a defensible method

Question 2

A researcher asks whether targeted phishing feedback reduces repeat clicks compared with annual training over six months. Which PICOT element is represented by “over six months”?

A. Population

B. Comparison

C. Outcome

D. Time

Correct Answer: D. Time

Question 3

Which situation most clearly illustrates a confounding factor?

A. A study records both training participation and click rates

B. A training group also has unusually strong security leadership that may explain its improvement

C. A researcher uses a median instead of a mean

D. An analyst documents a timestamp in UTC

Correct Answer: B. A training group also has unusually strong security leadership that may explain its improvement

Question 4

What is the principal purpose of a literature review in applied cybersecurity research?

A. To collect as many citations as possible

B. To replace the need for primary data

C. To synthesise existing knowledge and identify evidence gaps and limitations

D. To prove that the researcher’s preferred control is effective

Correct Answer: C. To synthesise existing knowledge and identify evidence gaps and limitations

Question 5

Which research approach is most suitable for understanding why analysts bypass a security control?

A. Qualitative interviews and observation

B. A malware hash comparison only

C. A purely cross-sectional count of alerts

D. A vulnerability severity ranking

Correct Answer: A. Qualitative interviews and observation

Question 6

Why should an IP address in a threat report not automatically be blocked?

A. IP addresses cannot be used as indicators

B. All threat reports are unreliable

C. The address may be shared, reassigned, or benign in the relevant context

D. Blocking controls are never appropriate

Correct Answer: C. The address may be shared, reassigned, or benign in the relevant context

Question 7

Which practice most directly improves reproducibility?

A. Keeping analysis decisions informal

B. Changing the analysis plan whenever results are inconvenient

C. Using undocumented manual spreadsheet edits

D. Maintaining version-controlled code, a data dictionary, and documented procedures

Correct Answer: D. Maintaining version-controlled code, a data dictionary, and documented procedures

Question 8

A statistically significant reduction in alert time is extremely small and has no operational effect. What distinction is most relevant?

A. Strategic versus tactical intelligence

B. Statistical significance versus practical significance

C. Reliability versus confidentiality

D. Validity versus source attribution

Correct Answer: B. Statistical significance versus practical significance

Question 9

In the illustrative endpoint analytics case, why were interviews combined with quantitative measures?

A. To avoid defining outcome measures

B. To explain how the tool changed analyst work and validation effort

C. To guarantee that the vendor claim was correct

D. To eliminate the need for a comparison group

Correct Answer: B. To explain how the tool changed analyst work and validation effort

Question 10

Which action best reflects ethical evidence-based practice when analysing employee security telemetry?

A. Collecting all available personal information indefinitely

B. Publishing identifiable user records to improve transparency

C. Applying data minimisation, access controls, and appropriate ethical review

D. Ignoring privacy because cybersecurity research is always beneficial

Correct Answer: C. Applying data minimisation, access controls, and appropriate ethical review