The void has a process

A clean check answers one question

A clean result from an integrity check means clean against what the tool knows. Everything outside that is still mine to look at.

A core checksum check compares the installed core files with the expected release. Matching core files leave the rest of the site to be examined. The first failure is trusting a tool with a question it was built to leave alone.

The site is clean and the source is still live

The second failure is treating incident response as a technical job. Find the bad files, remove them, harden the site, move on. The site is clean and the owner is reassured.

The servers delivering the malicious code may still be active, able to reach other sites.

The report is part of the response

Where evidence points to the servers delivering the malicious code, a report gives the people responsible for them something to examine. I see that as part of the response: carrying the finding beyond the site being repaired.

Reporting can fall outside the work someone was asked to do. The immediate problem is fixed, while a report adds work with an uncertain result. Sending one can feel like shouting into a void.

The void has a process. A host, a network or a national computer emergency team decides what to do with the evidence, and each can act beyond one site. The finding is worth putting in front of them.

The fix protects one site. The report might protect the next one.