Closing the accountability divide: How to prove what happened in a breach

It's not enough to contain an incident. You must also understand why and how it happened.