TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Stairwell

You Cannot Detect What You Did Not Keep: Why File Retention Is the Missing Security Control

Edward Roberts · 2026-03-17 · Read original ↗

ATT&CK techniques detected

2 predictions
T1486Data Encrypted for Impact
87%
“files preserve evidence. security programs that treat those two things as interchangeable are operating with a structural blind spot that only becomes obvious during a serious incident. the retention window problem most organizations maintain formal log retention policies. thirty…”
T1560.001Archive via Utility
55%
“actually happened. organizations that retain those files gain the ability to investigate the past with the same clarity they apply to the present. those that do not are forced to work from partial evidence and incomplete timelines. file retention is not an operational afterthough…”

Summary

TL;DR Security teams invest heavily in detection. But detection requires data, and the data most organizations keep is not the data investigations actually need. Logs record that something happened. Files reveal what it actually was. Attackers plan around retention windows. Hash lookups break the moment a payload is recompiled. A private file corpus that retains […]

The post You Cannot Detect What You Did Not Keep: Why File Retention Is the Missing Security Control appeared first on Stairwell.