The Five Ws of Cybersecurity: Who, What, When, Where, and Why

Every journalist learns early that a complete story answers five fundamental questions: Who, What, When, Where, and Why. It turns out these same five questions are the backbone of effective cybersecurity — whether you're investigating an incident, analyzing a log file, or building a detection strategy from scratch.

If your security program can't answer all five Ws about an event, you don't have the full picture. And in cybersecurity, an incomplete picture is a dangerous one.

Who: Identity Is Everything

The first W is about identity — and in a networked environment, identity is surprisingly hard to pin down.

"Who" covers every actor involved in an event: the user account that authenticated, the service account that made an API call, the external IP address that probed your perimeter, or the insider who exfiltrated data before resigning. It also includes the who on your side — which analyst responded, which team owns the affected system, and who has authority to make containment decisions.

In practice, answering "Who" requires:

• User and account attribution — mapping activity back to a real person or service, not just a username
• Device identity — knowing which endpoint, server, or cloud instance generated the event
• Threat actor profiling — when external, understanding whether the activity matches known adversary TTPs (Tactics, Techniques, and Procedures)

One of the most common failures in incident response is conflating an account with a person. A compromised service account doesn't tell you who is behind the keyboard — it tells you what credential was used. Digging deeper to answer the real "Who" is what separates a surface-level investigation from a thorough one.

What: Defining the Event

"What" describes the action or artifact at the center of your investigation. This is often where analysts start, but it's rarely where they should stop.

What happened? A file was encrypted. A privileged account was created. An outbound connection was established to an unfamiliar IP. A vulnerability was exploited. Each of these is a "What" — but without the other four Ws, it's just a data point without context.

Strong "What" analysis includes:

• Event classification — is this a policy violation, a misconfiguration, malware execution, or active exploitation?
• Artifact analysis — examining the file, process, registry key, or network packet at the center of the event
• Impact scoping — what data, systems, or services were affected?
• MITRE ATT&CK mapping — aligning the observed behavior to known adversary techniques

The "What" is your evidence. Treat it like a crime scene — document everything, preserve integrity, and resist the urge to jump to conclusions before you've answered the other four questions.

When: Timing Tells the Story

Timestamps are among the most underappreciated assets in a security investigation. "When" isn't just about knowing what time something happened — it's about understanding sequence, duration, and timing patterns that reveal intent.

A login at 2:00 AM from a user who always works 9-to-5 is a very different event than the same login at 10:00 AM. A process that runs for three seconds is different from one that runs for three hours. Lateral movement that happens over 48 hours looks different from a smash-and-grab attack that completes in 20 minutes.

Key "When" considerations:

• Log timestamp integrity — are your clocks synchronized via NTP? Inconsistent timestamps across systems make correlation nearly impossible
• Timeline reconstruction — building a chronological sequence of events to understand the attack chain
• Dwell time — how long was the attacker present before detection? The industry average is still measured in weeks, not hours
• Business context — does the timing align with normal business hours, scheduled maintenance, or known user behavior?

For small businesses and government contractors especially, understanding when an event occurred relative to other activity — a new employee's first day, a recent software update, a contract deadline — can be the difference between a fast containment and a prolonged breach.

Where: Location in Every Dimension

"Where" in cybersecurity is multidimensional. It covers physical location, network location, and logical location within your environment — and all three matter.

Where was the source IP geographically? Where in your network did the activity originate — the DMZ, an internal VLAN, a cloud workload? Where did the attacker move after initial access? Where is the data they targeted stored?

Answering "Where" requires:

• Network topology awareness — you can't detect east-west movement if you don't know what normal traffic between segments looks like
• Asset inventory — knowing what systems exist, where they live, and what they're authorized to communicate with
• Geolocation and IP intelligence — understanding whether a source IP is a known VPN exit node, a Tor relay, a cloud provider range, or a residential ISP
• Cloud and hybrid visibility — in modern environments, "where" extends to SaaS applications, cloud storage buckets, and containerized workloads that may not be visible to traditional on-premises tools

For organizations operating under CMMC or FISMA requirements, "Where" also has a compliance dimension — data must reside in authorized locations, and access from unauthorized locations is itself a reportable event.

Why: Motive Drives Strategy

The final W is the hardest to answer — and the most strategically valuable. Understanding why an attacker targeted you, why they chose a particular technique, or why an insider took a specific action shapes everything from your immediate response to your long-term security investments.

"Why" operates at multiple levels:

• Tactical why — why did the attacker use this specific technique? Was it to avoid detection, to escalate privileges, or to establish persistence?
• Strategic why — what is the ultimate objective? Data theft, ransomware deployment, espionage, sabotage?
• Targeting why — why you? Are you a primary target because of your data or contracts, or a stepping stone to a larger target in your supply chain?

For small businesses, the answer to "Why" is often opportunistic — automated scanners found an unpatched system or a weak password. For government contractors, the answer may be far more deliberate, tied to the sensitive programs or clearances your organization holds.

Understanding motive helps you prioritize. If you're being targeted for your DoD contract data, hardening your HR system is less urgent than locking down your classified project repositories. The "Why" tells you where to focus.

Putting It All Together: The Five Ws in Practice

The real power of the five Ws framework is in how the answers interact. A single W in isolation is a data point. All five together are a story — and stories are what drive effective response.

Consider a ransomware event:

• Who — a domain admin account, later traced to a phishing email opened by a contractor
• What — mass file encryption using a known ransomware variant, preceded by credential harvesting and lateral movement
• When — encryption began at 11:47 PM on a Friday; the initial phishing click occurred 72 hours earlier
• Where — originated on a contractor's laptop connected via VPN; spread to three file servers before containment
• Why — financially motivated threat actor targeting professional services firms with DoD contracts

That complete picture tells you what to fix (contractor onboarding and VPN segmentation), what to monitor (after-hours privileged account activity), and what to report (potential CUI exposure under CMMC requirements).

Building the Five Ws Into Your Security Program

You don't need a SOC or a SIEM to start applying this framework. Even small teams can build "Who, What, When, Where, Why" into their incident response checklists, their log review processes, and their post-incident reviews.

Start by asking: for every security alert your tools generate, can you answer all five questions? If not, identify the gaps. Maybe you lack user attribution (Who). Maybe your timestamps are unreliable (When). Maybe you have no visibility into lateral movement (Where).

Those gaps are your roadmap.

Cybersecurity is fundamentally an information problem. The five Ws are how you make sure you're asking the right questions — and getting complete answers before you act.

---

GEL LLC provides cybersecurity consulting, vulnerability assessments, and penetration testing for small businesses and government contractors. If you're not sure whether your security program can answer the five Ws, that's a conversation worth having.