Asked an experienced staff member to explain their investigative process to a new starter and been met with a blank stare, a hand wave and a vague "I just do what makes sense"? Even worse, "I re-image the machine and move on"! As an industry, we can do better than this, and this talk will show you how you can apply a decision making model around your thinking - from level one SOC to in-depth system investigation - to enhance your investigations today.