Say "I do not know" in a security meeting by pairing it with three things: what you do know, how you will find out, and when you will report back. That turns an admission into a plan, and it protects your credibility far better than a confident guess that proves wrong.
Why it matters more in security
Security decisions often rest on facts that are hard to confirm quickly: whether a flaw is exploitable here, whether data was touched, whether a control worked. People in the room want certainty, and silence or a guess feels easier than saying you are unsure. But a wrong "we are not affected" can cause far more harm than an honest "we are still checking".
The three part answer
| Part | Example |
|---|---|
| What I know | "The vulnerable library is in two of our services." |
| What I do not know | "I do not yet know whether the affected function is called." |
| Plan and time | "The service owners are tracing it now. I will update you by 3 pm." |
Say each part out loud, in that order. It sounds competent because it is.
Phrases that work
- "I do not have that yet. Here is what I can say with confidence."
- "My estimate is X, and my confidence is moderate because of Y."
- "That depends on a fact we have not confirmed. Here is how we are confirming it."
- "I would rather give you a correct answer in an hour than a fast guess now."
Phrases to retire
- "Probably fine." Without a basis, this is a guess dressed as an answer.
- "I think so" when you mean "I have no idea".
- "Nothing to worry about." Unless you have checked, you cannot say that.
Show confidence levels
Leaders can handle uncertainty if it is labelled. Use a simple scale: confirmed, likely, possible, unknown. Add the evidence behind each. "Confirmed: the library is present. Possible: exploitation, no evidence either way yet." This lets listeners calibrate and avoids a false sense of precision.
Deal with pressure
Sometimes a senior person demands a yes or no now. Offer a bounded answer: "If I have to decide now, I would treat it as affected until we show otherwise, because the cost of waiting is low and the cost of being wrong is high." This gives a safe default without claiming knowledge you lack.
Follow through
The promise to report back is the whole trick. Put the time in your calendar, send the update even if it is "still checking, next update at 5 pm", and correct any earlier statement quickly if facts change. Over time, people learn that your "I do not know" is followed by an answer, and your confident statements carry more weight.
Build the habit in the team
Leaders set the tone. When someone says "I do not know, and here is how I will find out", thank them. If people fear looking uninformed, they will guess, and a team of guessers produces confident wrong answers in an incident.
Safeguard's reachability analysis and asset discovery turn some "I do not know" moments into checks you can run in minutes. The free scan at gold.safeguard.sh/scan lets you try one on your own project.
Quick check
Will saying I do not know hurt my reputation?
Not when you add a plan and a time, and then deliver. Repeated confident errors hurt far more.
What if I must decide before I know?
Choose the safer default, say that it is a default, and name what would change the decision.
Last reviewed: 19 October 2026.
