Can you explain why something is unsafe?

A supplier’s portal is flagged as unsafe.

Someone in finance stops a payment. The supplier calls to ask why. The account manager contacts the security team.

The answer comes back: “The system gave it a high risk score.”

That describes the result. It does not explain the concern.

Was the portal observed stealing credentials? Does its domain resemble another company’s? Is the finding historical? Does the warning concern the whole website or one particular page?

Those distinctions determine whether the appropriate response is to block access, verify a request, investigate further or correct a mistaken assessment.

An unsafe verdict should be the beginning of an explanation that supports action.

Separate the evidence from the judgement

Consider three statements:

The domain was registered recently.

The domain may be impersonating a supplier.

Users should not enter credentials on the website.

The first is an observation. The second is an assessment. The third is a recommended action.

They may form part of a reasonable conclusion, but the reasoning between them needs support. Recent registration alone cannot establish impersonation or credential theft.

A stronger case might include a page presenting itself as the supplier’s official portal, confirmation that the supplier has not authorised it, and observed behaviour consistent with credential collection.

The recommendation can then be traced to specific evidence.

That traceability matters whether the judgement comes from an analyst, a rules engine or an AI model. A fluent explanation cannot compensate for evidence that does not support the conclusion.

What a defensible verdict should contain

A useful assessment should be able to answer six questions.

• What was observed? The behaviour or evidence behind the finding.
• What is affected? The specific URL, domain, address, account or service involved.
• When was it observed? The age of the evidence and the time of the latest relevant check.
• How confident is the assessment? The strength, consistency and limitations of the supporting evidence.
• Why does it matter here? The consequence for the activity the user is attempting.
• What should happen next? A proportionate action, with a route for review or escalation.

These answers do not all need to appear in a browser notification. They should exist behind the verdict and be available to the people responsible for acting on it.

Severity and confidence answer different questions

A potential incident can be serious even when the evidence is incomplete.

Suppose a newly reported portal may be collecting administrator credentials. The consequence of proceeding could be severe, while confidence in the report remains limited.

That combination may justify a temporary pause and urgent verification. It does not justify presenting the allegation as a confirmed fact.

Conversely, there may be strong evidence of a historical issue with little relevance to the current interaction.

A useful assessment separates:

• Confidence: how well the evidence supports the conclusion.

• Potential impact: what could happen if the concern is valid.

• Urgency: how quickly a decision or response is needed.

FIRST’s guidance on communicating uncertainty recommends qualifying intelligence judgements and using consistent language so readers can interpret assessments correctly.

Combining these dimensions into a single unexplained score makes it harder to understand why an action is warranted.

A warning must help someone continue safely

Imagine an employee opening an unexpected supplier sign-in page.

“Unsafe: 92/100” provides a clear signal to stop, but little help with what follows.

An illustrative warning could instead say:

This page is associated with observed credential theft. Do not enter your password. Open the supplier’s established portal separately, or contact your security team to verify the link.

That explanation identifies the concern, connects it to the intended action and offers a practical next step.

Where the evidence is weaker, the wording should change:

This destination has not been verified as belonging to your supplier. Confirm it through your established contact before entering sensitive information.

The second message describes uncertainty. It should not be presented as if credential theft has been observed.

Specific wording helps users understand both the warning and its limits.

Different audiences need different detail

The employee, security analyst and board may all need to understand the same finding. They need different views of it.

The employee needs a concise reason and an immediate action.

The analyst needs the underlying observations, timestamps, source quality, scope and reasoning. They need enough detail to challenge the finding and investigate alternative explanations.

The service owner needs to understand which business activity is affected, what can continue and who can approve an alternative.

The board needs to understand exposure, operational consequences, response effectiveness and decisions requiring leadership.

The NCSC’s guidance on engaging boards focuses on improving cyber security decision-making through clearer communication. Its risk-management guidance also cautions against relying uncritically on risk metrics.

A board does not need a list of suspicious URLs to understand a supplier-related risk. It needs to know whether critical work is exposed, whether controls are effective and what remains unresolved.

The underlying evidence should remain consistent across those views.

An explanation should be challengeable

A defensible assessment is one that can be examined and revised.

That requires a way to ask:

Could this be an authorised service? Does the observation still apply? Was a shared IP address mistaken for common ownership? Has the affected page been removed? Did several reports all originate from one source?

These questions strengthen the assessment process.

They also make it possible to distinguish a false positive from a valid historical finding that no longer warrants the same action.

An override should have a reason, an accountable owner and a scope appropriate to the decision. A temporary exception for one verified workflow should not silently become permanent approval for everything associated with a domain.

Equally, a corrected finding should reach the places where the original verdict was used.

Explainability does not require exposing everything

Some supporting information may contain sensitive data, confidential reporting or details that cannot be shared broadly.

A useful explanation can still describe the evidence category, observation time, affected resource, confidence and recommended action.

More detailed supporting material can be restricted to authorised reviewers.

The goal is to provide enough information for the recipient to understand and assess the decision. Where evidence cannot be disclosed, that limitation should be acknowledged rather than replaced with unsupported certainty.

The audit trail should preserve the decision as it happened

A verdict can change after an action has been taken.

For that reason, an organisation should be able to reconstruct what was known at the time: the assessment used, its supporting evidence, the applicable policy, the action taken and any subsequent review.

A current lookup cannot necessarily explain yesterday’s decision.

This is where explainable intelligence becomes useful to cyber governance, risk and compliance. It helps show how evidence informed a particular action and whether the response followed the organisation’s process.

It also supports learning. If a warning was misunderstood, arrived too late or interrupted legitimate work, the organisation can identify what needs to change.

Measure whether the explanation works

A warning can be technically accurate and operationally unhelpful.

To assess its value, ask whether the recipient understood the concern, selected an appropriate next step and could obtain timely help.

For analysts, ask whether the evidence was sufficient to review the verdict. For service owners, ask whether the scope of disruption was clear. For leadership, ask whether reporting supported a meaningful decision.

Counting warnings cannot answer those questions.

An explanation earns its place by improving the response.

What this means for ThreatPrevent

At ThreatPrevent, our focus is high-confidence intelligence signals that support decisions about domains, IP addresses and email addresses.

Our view is that a useful verdict should be proportionate to the evidence, clear about its scope and connected to an appropriate action.

That means treating the explanation as part of the intelligence. It is how a finding becomes understandable to the person expected to act on it.

A concise label can help someone recognise a concern quickly. Behind that label, there should be a defensible answer to a straightforward question:

Why is this unsafe, and what does the evidence justify doing next?