The Chris Sanders method: investigate before you answer

Ask an AI why something went wrong and it will usually tell you at once, with confidence. That is the problem. A fluent answer to “why is the trial balance out?” or “did these two students copy?” can sound finished when nobody has checked a single piece of evidence.

A good doctor works differently. She listens to your symptoms, checks the common causes first, orders a test that could prove her guess wrong, and tells you how sure she is. Chris Sanders, a security investigator and educator, describes the same discipline for investigations. This guide shows you how to ask an AI to work that way.

✦

1

The idea in 30 seconds

Observe: is it real?

Check the problem actually exists before explaining it.

Watch the 30-second explainer

The idea in 30 seconds0:00 / 0:31

1. Observe: is it real? Check the problem actually exists before explaining it.
2. Ask the question out loud Write down exactly what you are trying to find out.
3. I believe ___ because ___ Every guess names its evidence. "Nothing is wrong" stays on the list.
4. Try to prove yourself wrong Look for the test that could rule each guess out.
5. Say how sure you are Low, moderate or high confidence, plus what is still untested.
6. Investigate before you answer.

Key takeaways

If you remember nothing else, remember these.

• Use this method for problems you need to diagnose: a figure that does not add up, a result that makes no sense, a sudden rise in complaints or defects.
• Ask the AI for “I believe ___ because ___” guesses, including the boring one that nothing unusual happened, and for evidence that could prove each guess wrong.
• Insist on a confidence level. A confident guess is not a finding.
• Sanders does not teach AI prompting. The prompt shortcut is our practice, so spell the stages out in a method card.

This guide builds on named-method prompting. If you have not read it yet, start there: it explains why a person’s name can work as a prompt, and where it can go wrong.

Who Chris Sanders is, and what we borrow

Chris Sanders is a security educator and the author of Practical Packet Analysis. His doctoral research at Baylor University studied how digital forensic analysts think.

He calls his model of how good investigators work Diagnostic InquiryDiagnostic InquirySanders' loop: observe, question, guess, test, conclude.. It describes how you close the gap between what you see and what really happened. He argues the process is the same whether an analyst is checking a security alert, searching a network for intruders or taking apart a harmful program.

Experts differ mainly because they carry more rules of thumbRules of thumb that tell an expert what to check next, such as 'if X, look at Y first'.. Sanders calls them heuristics. An experienced accountant has them too: when a trial balance is out, there are a few classic checks they run before anything else.

The five stages of Diagnostic Inquiry

Tap a step, or press Play to follow one investigation.

Loop until the evidence is enough

Loop until the evidence supports a conclusion: a false positive, an accepted risk or a confirmed problem.

Step 1 of 5

Observation

Something looks odd. Before chasing it, ask whether it is real or just noise in the data.

Step 2 of 5

Question

Turn the observation into one clear question you could say out loud.

Step 3 of 5

Hypothesis

Make a guess you can test, and write it as “I believe ___ because ___”.

Step 4 of 5

Answer

Look for evidence that would prove the guess wrong. Each answer usually raises a new question, so the loop goes round again.

Step 5 of 5

Conclusion

Stop when the evidence is enough, and say how sure you are. “Normal” is a valid conclusion too.

Play

3Write every hypothesis as

I believe ___ because ___

Can’t fill in the “because”? Suspect bias or missing evidence.

H₀Keep the null hypothesis open

Maybe the suspected thing did not happen at all. “Normal” is a valid conclusion, and often the most common one.

1. Observation. Something starts the investigation: a system warning, a report from a person, a number that looks wrong. Check it first. Is the problem itself real?
2. Question. Decide what you are trying to answer. Good questions are often about relationships: what changed, what is connected, what else happened at the same time.
3. Hypothesis. Propose a hypothesisHypothesisA best guess you can test, such as "the defects rose because of the new supplier".: a provisional answer you can test.
4. Answer. Gather evidence for and against it. Sanders stresses trying to disprove it, because that produces better questions.
5. Conclusion. State the outcome, for example a false alarm, an accepted risk or a confirmed problem, in words that show how sure you are.

The loop matters as much as the stages. Each answer raises a new question, and you go round again until the evidence is enough.

Habits that keep an investigation honest

“I believe ___ because ___”

Sanders suggests one sentence pattern for turning hidden assumptions into testable guesses: I believe ___ because ___. The second blank is the test. If you cannot fill in the “because”, you may be relying on bias or on experience you do not have.

Compare “someone in accounts was careless” with “I believe a RM620 payment was posted on the wrong side, because that would throw the totals out by exactly RM1,240”. Only the second tells you what to check.

The same works on a factory floor: “I believe the new solder-paste lot is causing the defects, because the rise started the day Line 3 switched lots.”

Keep the null hypothesis open

Always allow for the possibility that the thing you suspect did not happen. This is the null hypothesisNull hypothesisThe possibility that nothing unusual happened: the boring explanation you must rule out first.. When a trial balance is out, the null hypothesis is an ordinary keying slip, not fraud.

In Sanders’ writing, “normal” is a valid outcome and often the most common one. An investigation that cannot end in “nothing unusual happened” is not an investigation. It is a search for proof.

Try to disprove, then rate your confidence

Evidence that agrees with you is easy to find. Evidence that could prove you wrong is more valuable, so look for it on purpose.

When you conclude, give a confidence levelConfidence levelSaying how sure you are (low, moderate, high).: low, moderate or high, with the evidence behind it and what you have not yet tested.

Questions are the core unit

Sanders treats the whole investigation as one big question, with every action answering a smaller one. He observes that investigators often act on questions they never put into words.

Opening the ledger is really asking “which entries were posted after the last time the books balanced?” Saying the question out loud first makes it easier to check that the action answers it.

His recent work on investigation playbooks follows the same idea. A playbook starts from a warning sign and lists the questions worth asking, with where to find each answer. It supports your thinking rather than replacing it.

Differential diagnosis: horses before zebras

In 2012 Sanders borrowed differential diagnosisA doctor's method: list the possible causes of the symptoms, then rule them out one by one until one diagnosis remains. from medicine. When you hear hoofbeats, think horses, not zebras: check the common explanation first. Here it is applied to our trial balance.

✦

1

Differential diagnosis: the trial balance case

List the symptoms

Debits exceed credits by RM1,240. August balanced.

Watch the 30-second explainer

Differential diagnosis: the trial balance case0:00 / 0:26

1. List the symptoms Debits exceed credits by RM1,240. August balanced.
2. Common cause first A digit swap? 1,240 ÷ 9 is not a whole number, so probably not.
3. List all candidates Wrong side, missed posting, wrong account, unrecorded payment.
4. Rank by severity An unrecorded payment matters more than a keying slip.
5. Rule them out Half of 1,240 is 620: is a RM620 entry on the wrong side?

Those two checks, dividing by 9 and halving the difference, are an accountant’s heuristics. The AI can run them for you, but only if you ask it to investigate rather than to “find the error”. The lab further down lets you work this case through yourself.

Why this improves AI output

An AI’s default is to produce a plausible answer quickly. It rarely says “I don’t know yet” unless you make room for it. Diagnostic Inquiry changes the task in four ways:

• The AI states its questions. You can see what it thinks the problem is and correct it early.
• Its guesses come into the open. “I believe ___ because ___” shows the evidence behind each claim, or the lack of it.
• It looks for evidence against itself. It must name what would prove it wrong, which a confident guess skips.
• Certainty becomes a confidence level. You get “likely, moderate confidence, not yet tested: X” instead of a final verdict.

Before: vagueAfter: precise

Our student portal had a spike in failed logins last Friday. The logs are attached.

Use the Chris Sanders method: Observation → Question → Hypothesis → Answer → Conclusion. Check the spike is real first. State each question before you act on it. Write hypotheses as "I believe ___ because ___" and keep the null hypothesis open. Look for evidence that could disprove each one. Conclude with a confidence level and label each statement Confirmed or Hypothesis.

What you typically get back

A check that the spike is real, the main question stated, three candidate explanations including 'a normal event such as a password-reset deadline', the evidence for and against each, and a conclusion with a confidence level and a list of what is still untested.

How to use it with AI

1. The short shortcut

The quickest version is the line our author Mohd Fikri adds to his promptsPromptThe message or instructions you type to an AI. A better prompt usually means a better answer. when the task is an investigation:

Investigate why enrolment in our evening diploma dropped this semester. The last three years of enrolment data are attached.

Use Chris Sanders method to complete this task.

This relies on the AI recognising the name. Several well-known people share it, and different AI tools unpack it differently. That is why the next step matters.

2. The method card

For reliable results, paste a method card once: at the start of a chat, in your tool’s saved instructions, or in an AI agent’sAI agentAn AI that does a multi-step job for you (planning, opening files, using tools and checking its work) instead of only replying once. project file. Then the short line means the same thing for every AI tool and every teammate.

Method card: "the Chris Sanders method"
When I write "use the Chris Sanders method", I mean Chris Sanders' Diagnostic Inquiry model for investigations (Chris Sanders, the information-security educator).
1. Observation: check the observation is real before explaining it.
2. Question: state each question before you act on it. Answers will raise new questions; loop back.
3. Hypothesis: write each one as "I believe ___ because ___". Always include the null hypothesis: the suspected thing did not happen.
4. Answer: look for evidence that could disprove each hypothesis, not only evidence that supports it. When many causes are possible, check the most common first, then rank the rest by severity and rule them out.
5. Conclusion: give a confidence level (low, moderate or high). Label every statement Confirmed (from evidence I gave you) or Hypothesis. List what is not yet tested.
Never invent evidence. If you need data you do not have, ask me for it.

Put the card together with a clear AIM brief: the card tells the AI how to work, and AIM tells it what to work on.

For developers: technical detailsOptional: skip this if you only use the chat app

• Put the method card in the system promptSystem promptStanding instructions set up before the conversation starts, such as "always answer in Bahasa Melayu". They apply to every reply. or in the instruction file your agent reads at start-up, so every run uses the same definition.
• For investigations you want to log or compare, ask for structured output with one record per hypothesis: statement, because, evidence_for, evidence_against, status (Confirmed or Hypothesis) and confidence (low, moderate or high).
• Give the agent read-only access to the evidence. An investigation should not change the data it is investigating.

Practise on a case

Work through two cases. At each stage, pick the strongest move. Wrong picks explain themselves, and at the end the lab turns your investigation into a ready-to-use prompt with the method card built in.

Interactive

Investigation lab: work a case

0/3

Pick a case. At each stage, tap the best move. If you pick a weaker one, read why and try again. At the end you get a ready-to-copy prompt.

Line 3 defectsTrial balanceSimilar reports

1. Observation
2. 2Question
3. 3Hypothesis
4. 4Answer
5. 5Conclusion

Defect rate jumped 4% on Line 3

An electronics plant in Penang. You are the quality engineer.

Observation (validated)

This week’s inspection report shows solder-bridging defects on Line 3 rising from 1.5% to 5.5%. Lines 1 and 2 are unchanged. You checked that the inspection settings did not change, so the jump is real.

Stage 2 · Question

Which question should drive the investigation?

AWho on Line 3 is not following the procedure?BWhat changed on Line 3, and only on Line 3, around the time the defect rate rose?CHow can we bring the defect rate down quickly?

Worked examples beyond security

These examples are our interpretation of Sanders’ model for other fields. He did not write them.

An accounts executive with a trial balance that will not agree

This is the case from the differential diagnosis above, written as a prompt. Notice that it asks for questions and tests, not for “the answer”.

Our trial balance for September is out by RM1,240: debits exceed credits. August balanced. The September journal listing and general ledger export are attached. Staff names are replaced with codes.

Main question: Which entry or entries explain the RM1,240 difference?

Use the Chris Sanders method (the card above). Include the null hypothesis that this is an ordinary keying slip, not a missing or improper transaction. Start with the common checks: a transposed figure, an amount posted on the wrong side, a one-sided entry. For each hypothesis, name the entries I should look at. Do not adjust any figures.

A researcher with contradictory results

Your survey says SME owners trust AI tools, but your interviews say they do not. Treat the contradiction as the observation, not as an error to smooth over. Our AI for research guide covers the wider workflow.

My survey of 210 Malaysian SME owners shows high trust in AI tools, but my 12 interviews show distrust. Both instruments and my coding notes are attached.

Main question: Why do the two data sources disagree?

Use the Chris Sanders method (the card above). List at least four hypotheses, including the null hypothesis that the two instruments measured different things and do not truly conflict. For each, state what evidence in my data would disprove it. Do not invent quotes or figures.

A lecturer looking at a similarity flag

A similarity report flags two lab reports. The method protects the students as much as the course: the null hypothesis (a shared template, cited quotes, permitted group data) has to be ruled out with evidence. The lecturer, and then the institution’s process, makes the decision.

Two Year 2 lab reports share 38% matched text. Names and matric numbers are removed. The brief allowed group data collection but required individual write-ups. The matched passages are attached.

Main question: What exactly overlaps, and does a legitimate shared source explain it?

Use the Chris Sanders method. Sort each matched passage into: template, cited quote, shared dataset, or unexplained. For unexplained passages, suggest neutral questions I could ask each student. Do not conclude misconduct. That decision belongs to our academic integrity procedure.

A Penang factory with rising defects

A quality engineer sees solder defects climb on Line 3 only. Check the common cause first (a new material lot or a changed setting), list the other candidates, rank them by impact on customers, then rule them out with trials. The lab above walks through this case step by step.

Check your understanding

Check yourself

Diagnostic Inquiry in five questions

1/5

Pick an answer, then tap Check answer. You can also use the arrow keys to move between answers.

Question 1 of 5: Which task is the best fit for the Chris Sanders method?

ADraft ten quiz questions on cash-flow statementsBFind out why the September trial balance is out by RM1,240CTurn this morning’s meeting notes into minutes

Check answer

Sources

7

1. 1How analysts approach investigations (Diagnostic Inquiry), 2016 (opens in a new tab)chrissanders.org
2. 2Questions in investigations, 2015 (opens in a new tab)chrissanders.org
3. 3Differential diagnosis applied to network security monitoring, 2012 (opens in a new tab)chrissanders.org
4. 4Infosec mental models: the investigation process, 2019 (opens in a new tab)chrissanders.org
5. 5Human-centered investigation playbooks, 2025 (opens in a new tab)chrissanders.org
6. 6Investigation Theory course, Applied Network Defense (opens in a new tab)networkdefense.co
7. 7About Chris Sanders (opens in a new tab)chrissanders.org

Nice work!

Lesson complete

You made it to the end. Take the quiz above if you have not yet, for bonus XP.

• 0 XP
• 0 day streak