In Sir Arthur Conan Doyle’s 1892 Sherlock Holmes short story “The Silver Blaze” we find this snippet:
[Detective Gregory:] “Is there any other point to which you would wish to draw my attention?”
[Holmes:] “To the curious incident of the dog in the night-time.”
[Gregory:] “The dog did nothing in the night-time.”
[Holmes:] “That was the curious incident.”1
I don’t want to give away the whole story, but what’s important here is the event that didn’t happen. In other words, Holmes examined the negative space to find the answer. In practice this is usually harder than it seems, but it’s even harder when we don’t think about the principle.
Here’s an example. I spent some time during my career as an editor. When editing, it’s very easy to fall into the trap of seeing the words on the page and allowing those words to create a groove in your mind. As you read and re-read the same words, the groove deepens. As a result, it becomes more and more difficult to see the words that aren’t there (the negative space). Let’s say the author lists five important facts about red teaming. You edit those for style and grammar and move on, forgetting to consider whether the list is complete. It’s the exceptional editor who regularly considers the negative space.
As red teamers, exploring the negative space can be more important than looking at the positive space. In fact, the positive space has often been explored repeatedly by the customer, and it’s your job to consider the dog that didn’t bark. To help you remember, we’ve added this sticker to the collection:
Mark Mateski is the founder and editor of Red Team Journal.