Your team found some of the evidence, but missed the critical behaviour or attack path that allowed the incident to continue. The attacker did not need advanced malware. They needed pressure, confusion, and one unsafe decision at the wrong moment.