A company suffered a data breach that led to a six-figure insurance claim. The insurer denied the payout. Why? The audit logs that would have shown when and how the attacker entered had been overwritten. The retention policy—set at 30 days to save on storage costs—had rotated the evidence into oblivion. The claimant lost the payout, and the attacker walked away untraced.

The $600,000 Log That Never Rotated

In 2024, a mid-sized SaaS provider discovered that an attacker had exfiltrated customer data over a period of several months. The company filed a claim under its cyber insurance policy, expecting reimbursement for breach response costs and regulatory fines. The insurer, however, denied the claim on the grounds that the company had failed to maintain adequate security controls.

The specific deficiency: audit logs covering the intrusion window had been retained for only 30 days. By the time the breach was detected, the logs for the earliest entry point had already been overwritten. The insurer argued that without complete logs, it could not verify the timeline or scope of the incident, and therefore could not confirm that the company had followed its own incident response plan.

According to industry sources familiar with the case, the claim amount was roughly $600,000. The payout was zero. The company absorbed the full cost—forensic investigation, legal fees, customer notifications, and reputational damage. The decision hinged on a single policy parameter: log retention duration.

This is not an isolated incident. Cyber insurance underwriters have become increasingly strict about requiring detailed evidence of security controls. A 2024 survey by a major broker found that roughly 15% of cyber claims were denied or reduced due to insufficient log evidence. As insurers tighten terms, the cost of a short retention policy can easily exceed the cost of storing logs for years.

Consider another recent example: a healthcare organization faced a ransomware attack that encrypted patient records. The attackers gained access through a compromised VPN credential, but the VPN logs were retained for only 14 days. By the time the breach was discovered, the logs had been overwritten. The organization's cyber insurance policy required evidence of multifactor authentication usage, but without logs, they could not prove MFA had been active. The claim was reduced by 30%, costing the organization roughly $200,000 in uncovered costs. These cases illustrate a growing pattern—insurers are using log retention as a proxy for overall security maturity.

Why Retention Policies Are a Security Liability, Not Just Compliance

Most organizations set log retention periods based on compliance frameworks. HIPAA requires six years for certain records. PCI DSS mandates one year for access logs, with three months immediately accessible. SOC 2 often recommends six to twelve months. These are useful baselines, but they were not designed for forensic readiness.

Compliance minimums are a floor, not a ceiling. A policy that satisfies an auditor may still be too short to catch a slow-moving intrusion. Advanced persistent threats often dwell for 100 to 200 days before exfiltration. If logs rotate every 90 days, the earliest evidence of reconnaissance is gone before the breach is discovered.

On the other hand, retaining everything indefinitely creates its own risks. More logs mean a larger attack surface for adversaries who gain access to log storage. A long retention period without proper access controls can turn a log repository into a treasure trove of sensitive information. The balance is delicate.

Research from Georgia Tech's School of Computer Science has highlighted the tension between retention and security. In a 2022 paper, researchers showed that many log systems lack built-in integrity guarantees, making it possible for an attacker to modify or delete logs retroactively. Without cryptographic sealing, even long retention does not guarantee trustworthy evidence.

There is also a performance trade-off. Retaining logs for years can degrade query performance if the log management platform is not designed for scale. Some organizations find that querying a year's worth of authentication logs takes minutes, which is unacceptable during an active incident. Tiered storage—hot, warm, cold—can mitigate this, but adds complexity. A common approach is to keep the most recent 90 days in fast, indexed storage, and archive older logs in cheaper, slower storage that can be loaded on demand. However, if the archive is not indexed, forensic analysts may have to wait hours or days to retrieve relevant data. This delay can be critical when an insurer requires a rapid response.

The Real Culprit: Authentication Logs Without Chain-of-Custody

The core problem is not just how long logs are kept, but whether they can be trusted. In the denied claim case, the authentication logs showed failed login attempts and successful sessions, but they were stored on a standard syslog server with no write-once enforcement. The company could not prove that the logs had not been tampered with after the incident.

Chain-of-custody for digital evidence requires that logs be immutable and verifiable. Cryptographic hashing, digital signatures, or append-only storage can ensure that no entry is altered or deleted after creation. Without these measures, an insurer can argue that the logs might have been modified to hide negligence.

Many mid-market organizations run syslog servers with default configurations that allow any user with root access to delete or modify log files. A 2023 survey by a security vendor found that roughly 40% of companies with over 500 employees still used writable log storage for authentication events. This is a forensic failure waiting to happen.

The Georgia Tech research on log integrity gaps underscores the point. The researchers demonstrated that in a typical Linux environment, an attacker with compromised credentials could overwrite log entries without detection. Even if logs are retained for a year, they are worthless as evidence if they can be altered.

But immutability is not a silver bullet. Even if logs are append-only, an attacker can still flood the log stream with false entries, making it harder to find the real evidence. This is a form of denial-of-service against forensic analysis. To counter this, organizations need both immutability and anomaly detection—alerting on unusual log volumes or patterns. Some platforms now use machine learning to flag log entries that deviate from baseline behavior, but these tools are still early-stage and can produce false positives. A balanced approach is to retain all logs immutably, but apply filtering and aggregation to reduce noise, while keeping the raw data available for deep dives.

How Supply-Chain Partners Exploit Log Gaps

Retention gaps are not limited to internal systems. Supply-chain attacks often leave traces in vendor logs that the victim never sees. A third-party integrator may have access to production systems, but the client may not retain logs of that vendor's activity. When the vendor is compromised, the client cannot reconstruct the attack path.

Consider the recent beta of DoorDash's command-line interface, dd-cli, which allows developers and AI agents to place orders programmatically. The authentication logs for those agent sessions are generated on DoorDash's side, not the customer's. If a customer's API key is stolen, the relevant logs are retained only per DoorDash's policy, which may not align with the customer's forensic needs.

Similarly, OnePlus's recent shutdown of US and European operations left device logs orphaned. OnePlus promised continued support for existing phones, but the servers that store cloud-synced logs may be decommissioned over time. Users who relied on those logs for security investigations will find them gone.

Integration contracts rarely specify log retention periods or access rights for forensic purposes. Companies assume that their partners keep logs, but they rarely verify the retention duration or the integrity guarantees. When an incident crosses organizational boundaries, missing logs become a liability for both parties.

Another example: a financial services firm used a third-party payment processor that stored transaction logs for only 45 days. When a dispute arose over a fraudulent transaction that occurred 60 days prior, the logs had already been deleted. The firm could not prove that the transaction was unauthorized, and the payment processor's insurance denied the claim. The firm had to absorb the loss. This is a common scenario in the payments industry, where retention periods are often dictated by card network rules rather than forensic needs. Companies should negotiate log retention clauses in vendor contracts, specifying a minimum of 12 months for authentication and transaction logs, with immutable storage and the right to audit.

The Economics of Log Storage vs. Claim Payouts

Why do companies set short retention policies? The obvious answer is cost. Storing logs in Amazon S3 cold storage costs roughly $1 per terabyte per month. But that price does not include indexing, search, or retrieval. A typical mid-sized company generating 100 GB of logs per day would face monthly storage costs of around $3,000 for raw storage, plus additional costs for a log management platform.

Over a year, that adds up to tens of thousands of dollars. For a startup or mid-market firm, that is real money. The temptation is to rotate logs after 30 or 60 days, saving 90% of the storage cost. But the trade-off is invisible until a claim is denied.

IBM's 2024 Cost of a Data Breach report estimated the average breach cost at roughly $4.5 million. Even a small breach can cost $200,000 in forensic investigation and legal fees. A denied insurance claim shifts that entire cost to the victim. The ROI of retaining logs for 12 months instead of 30 days is enormous, but it is rarely calculated because the risk of denial is abstract.

Insurance underwriters are starting to penalize short retention. Some policies now explicitly require log retention of at least 12 months for authentication events. Companies with shorter policies may face higher premiums or exclusions. The economics are shifting: log storage is cheap; claim denial is expensive.

But there is a counter-argument: not all logs are equally valuable. Retaining every debug log, application trace, and system message for years is wasteful. A smart approach is to categorize logs by criticality. Authentication logs, network flow logs, and database access logs are high-value for forensics. Application debug logs, on the other hand, are rarely needed after a few weeks. By applying different retention tiers, organizations can focus storage budget on the logs that matter most. For example, keep authentication logs for 12 months, network logs for 6 months, and debug logs for 30 days. This reduces total storage cost while preserving forensic capability where it counts.

Practical Moves: Immutable Logs and Retention Tiers

What should a security-conscious organization do? The first step is to separate forensic retention from compliance retention. Compliance logs can be kept at the minimum required duration, but authentication and access logs should be retained for at least 12 months—longer if the organization faces advanced threats.

Second, enforce immutability. Write-once storage for audit events prevents tampering. Technologies like AWS CloudTrail with S3 Object Lock, or on-premises append-only log servers, can provide cryptographic guarantees. Any log that can be modified after creation is not evidence.

Third, automate alerts on retention policy changes. If a log rotation window is shortened, the security team should be notified immediately. A change in retention policy can be a sign of an attacker covering tracks, or a well-meaning admin trying to save space. Either way, it merits investigation.

Fourth, conduct regular drills. Restore logs from cold storage and replay an attack scenario. Verify that the logs are intact and that the chain-of-custody holds. These drills expose gaps before an incident occurs. They also demonstrate to insurers that the organization takes forensic readiness seriously.

Finally, review supply-chain contracts. Specify minimum log retention periods for vendors that access your systems. Require that authentication logs be stored immutably and made available for forensic analysis upon request. If a vendor cannot meet these requirements, consider whether the access is worth the risk.

One practical implementation detail: when using cloud-based log storage, enable versioning or object lock to prevent deletion or modification. For on-premises systems, consider using a dedicated log server with a read-only file system or a hardware security module that signs log entries. These measures add cost and complexity, but they are trivial compared to a denied claim. A mid-sized company might spend an extra $10,000 per year on immutable storage, but that investment protects against a potential $600,000 loss. The math is clear, yet many organizations still treat logs as disposable.

The Revisionist Take: Security Dictates Retention, Not Compliance

The conventional wisdom is that log retention should be driven by regulatory requirements. That is backward. Security requirements should dictate retention, and compliance should be a side effect. A policy designed to satisfy an auditor may fail catastrophically when an incident occurs.

Insurance underwriters are beginning to understand this. Some now ask for proof of log retention during the application process. Others require that logs be stored in immutable format. As the market matures, short retention will become a red flag that raises premiums or triggers exclusions.

The company that lost its six-figure claim learned this the hard way. Its 30-day retention policy was compliant with PCI DSS, but it was not sufficient for forensic readiness. The insurer did not care about compliance; it cared about evidence. Without evidence, the claim was denied.

Retention is not a cost center; it is an insurance policy. The cost of storing logs for a year is a fraction of the cost of a single denied claim. Organizations that treat logs as disposable are gambling that they will never need them. When the gamble fails, the loss is measured in dollars—and sometimes in the business itself.

But let's address a common objection: "We've never had a breach, so why spend more on logs?" This is survivorship bias. The absence of a past incident does not predict the future. The threat landscape is evolving, and dwell times are increasing. A 2024 report from a security vendor found that the median dwell time for ransomware attacks was 5 days, but for data exfiltration it was 70 days. If your retention policy is shorter than the dwell time, you are blind. The only way to know if you've been breached is to have the logs to look back at. And if you don't have them, you might never know.

Another objection: "Our insurer didn't ask for log retention details." That may be true today, but policies are being rewritten. In 2025, more insurers are expected to require specific retention durations as a condition of coverage. Waiting until the policy renewal to discover the requirement is risky. Proactive improvement now can prevent a denial later.

Finally, some organizations argue that log retention is a privacy concern. Storing authentication logs for a year means holding IP addresses, timestamps, and usernames that could be used to track user behavior. This is a legitimate concern, especially under regulations like GDPR. The solution is not to delete logs, but to anonymize or pseudonymize them after a certain period, while retaining the ability to re-identify them for forensic purposes if needed. Techniques like tokenization or hashing can preserve privacy while maintaining forensic value. This is an area where legal and security teams must collaborate to find a balance.

In the end, the decision to retain logs is a decision about risk tolerance. Short retention is a bet that you will never need those logs. Long retention is a bet that you will. Given the stakes, the prudent bet is to keep logs long enough to survive an investigation. The six-figure claim denial is a cautionary tale, but it doesn't have to be your story.