The dark figure of crime is the gap between incidents that happen and incidents that are actually detected or recorded. In security, it describes unseen activity that never reaches telemetry, signatures, or case management. For defenders, the concept matters because statistics based only on caught events can create a false sense of completeness.
Expanded Definition
The dark figure of crime is the unseen portion of hostile or harmful activity that exists outside detection, logging, reporting, or case handling. In security, it describes the difference between what is actually happening and what defenders can prove from telemetry alone. That gap can exist because an event was never instrumented, alerts were suppressed, logs were incomplete, or incidents were not recognised as incidents at all.
The term is often used in analytics, fraud, and threat management to remind practitioners that recorded events are not the full population. A mature reading of the concept separates it from simple reporting delay: the dark figure is not just slow data, but missing data. It also differs from false positives or false negatives, because those are properties of specific detections, while the dark figure is a broader visibility problem.
Guidance versus consensus: security teams generally agree the dark figure is real, but there is no universal method for measuring it directly. Any estimate is usually indirect, based on audits, sampling, investigations, or external benchmarks rather than complete ground truth.
Examples and Use Cases
- A SOC reviews endpoint alerts and assumes low activity, but unmanaged hosts, blind spots, and short retention windows leave part of the attack surface unobserved.
- A fraud team sees few confirmed cases in a reporting period, yet manual reviews show that many low-confidence cases were never escalated into the case system.
- A cloud team relies on control-plane logs, but identity events from some services are not retained long enough to reconstruct the full sequence of access.
- An incident response team compares detections with post-incident evidence and finds that several precursor actions were never logged, only the final compromise was visible.
- In NHI environments, service accounts or API keys may be active across many systems, but only the systems with strong telemetry reveal misuse; the rest contribute to the unseen gap.
A common implementation reality is that better tooling does not automatically shrink the dark figure if ownership, retention, or logging scope remains inconsistent. Visibility is usually uneven across systems, not uniformly absent.
For a related identity-governance angle, see OWASP Non-Human Identity Top 10.
Security Implications
The main security problem is overconfidence. When leaders measure only detected events, they can mistake incomplete evidence for low threat exposure, which distorts prioritisation, staffing, and control investment. The result is often a false baseline: teams optimise for the portion of activity they can already see while the unseen remainder persists unchanged.
Operationally, the dark figure can mask reconnaissance, abuse of low-noise identities, policy drift, and slow-burn compromise. It also makes trend analysis fragile because apparent improvement may simply mean fewer events are being captured, not fewer events occurring. In investigations, the dark figure can limit root-cause analysis by hiding the earliest observable precursor, which weakens containment decisions and makes scoping uncertain.
Practitioner observation: if one control plane, business unit, or identity class consistently produces incident evidence while another stays quiet, that silence should be treated as a visibility question before it is treated as a security win.
Domain and Governance Relevance
In cybersecurity governance, the dark figure of crime is a reminder that metrics are only as reliable as the collection model behind them. It matters in resilience planning, detection engineering, audit scope, and board reporting because a low count of recorded events may reflect poor observability rather than low risk. That distinction affects how organisations allocate monitoring coverage and how confidently they trust “no findings” reports.
Where identity and NHI are involved, the issue becomes sharper because machine identities often operate across many systems, with indirect or fragmented telemetry. Missing logs for service accounts, tokens, certificates, or automated agents can create a hidden corridor of activity that traditional user-focused monitoring does not expose. In that context, the dark figure is not abstract statistics; it is a governance signal about where trust, ownership, and evidence collection do not line up.
For NHIMG readers, the core governance question is whether your evidence model can actually observe the identities, workloads, and actions that matter most, or whether it only records the subset that is easiest to see.
Risk and Threat Considerations
The material risk is visibility failure: organisations can underestimate exposure when incidents, misuse, or abuse are only partially detected. This matters most where low-noise activity, weak logging coverage, or inconsistent retention allows harmful behaviour to remain outside the recorded dataset.
Failure mechanism: attackers and abusive insiders benefit from blind spots created by sparse telemetry, fragmented ownership, short retention, or systems that are outside normal monitoring paths. When only the final stage of compromise is recorded, earlier reconnaissance, credential misuse, and lateral movement can remain hidden.
Impact: defenders lose the ability to scope incidents accurately, identify patterns over time, or prove whether a control is working. That can delay containment, distort risk reporting, and leave repeated abuse unchallenged because the evidence never enters the case record.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM — Security Continuous Monitoring | The dark figure reflects monitoring gaps and unobserved security activity. |
| DE.AE — Anomalies and Events | Unknown or unrecorded events undermine anomaly baselines and event interpretation. | |
| RS.AN — Analysis | Incomplete evidence weakens incident scoping and root-cause analysis. | |
| Recommendation — Expand monitoring coverage to reduce unseen activity and improve detection confidence. Tune anomaly handling to surface events that fall outside expected patterns. Use incident analysis to reconstruct hidden precursor activity and validate scope. | ||
| CIS Controls v8 | 8 — Audit Log Management | The concept depends on whether events are actually captured and retained. |
| 13 — Network Monitoring and Defense | Unseen network activity is a core contributor to the dark figure. | |
| Recommendation — Centralise and retain logs so missing activity is less likely to stay invisible. Monitor network paths that may bypass primary detection or case systems. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Inventory and Ownership | Unowned or untracked machine identities often create unseen activity gaps. |
| Recommendation — Inventory non-human identities so hidden access paths are not left ungoverned. | ||
