Interview question
Tell me about a time your analysis turned out to be wrong. What happened, and what did you change?
The behavioural question that most reliably separates analysts with real experience from those without. Everyone has been wrong; the question is what you did about it.
What a strong answer covers
- Gives a specific, real example rather than a hypothetical or a disguised humblebrag.
- Identifies the actual mechanism of the error — anchoring, confirmation bias, mirror imaging, over-reliance on one source.
- Describes owning the error and correcting it publicly or with the stakeholder, not quietly.
- Describes a concrete process change, not just "I am more careful now".
- Shows the change generalised — a habit, a checklist step, a review practice.
- Does not blame the sources or the stakeholder for the error.
- Treats being wrong as normal in a probabilistic discipline rather than as a disaster.
Expert answer
The shape of a strong answer matters more than the specific incident, because the interviewer is testing intellectual honesty and whether you learn systematically.
A good answer has five parts. First, a specific and real example — an assessment made, a judgement that turned out wrong, with enough detail to be checkable. Vagueness here reads as either no experience or no honesty.
Second, the actual mechanism. Not "I did not have enough information", which is almost always available as an excuse, but the reasoning failure: anchoring on the first plausible explanation and interpreting everything after it through that lens; confirmation bias in the collection, where I stopped looking once the favoured hypothesis was supported; mirror imaging, assuming the adversary valued what I would have valued; or over-weighting one source because I trusted the brand.
Third, how it was handled. Reissuing the assessment plainly and telling the people who acted on it. Analysts who correct themselves openly build more credibility than they lose — the ones who quietly let a wrong assessment stand are the ones who become untrustworthy.
Fourth, a concrete process change. "I am more careful" is not a change. Adding an explicit alternative hypothesis to every assessment is. So is a key assumptions check before writing, or having a colleague argue the opposite case, or a rule that any judgement resting on a single source says so in the text.
Fifth, the framing. This is a probabilistic discipline. A team that is never wrong is a team that only publishes the obvious. What matters is calibration — that things assessed as likely happen about as often as claimed — and that errors produce process improvements rather than defensiveness.
Blaming the sources or the stakeholder for the error is the answer that fails.
Mistakes that cost candidates points
- A hypothetical instead of a real example.
- Choosing an "error" that is really a success story.
- Blaming sources, tooling or stakeholders.
- Identifying no specific reasoning failure.
- A vague resolution with no process change.
- Not mentioning correcting the record with the people who acted on it.
You have read the answer, which is the easy part. Answer it in your own words and get graded against this same rubric, with the follow-up probe an interviewer would ask next.
Go deeper
Related questions
- The SOC escalates: a finance team member's account authenticated successfully from an IP in a country the company has no presence in, at 03:00 local time. MFA was satisfied. No alerts have fired since. What do you do, and what do you tell the SOC lead?
- Walk me through how you would use Analysis of Competing Hypotheses on an intrusion where the evidence is ambiguous. What makes ACH different from just weighing the evidence?
- A senior analyst has written an assessment you think is wrong. It is going out to the CISO tomorrow. What do you do?
- You have been producing reports for six months and you suspect nobody is reading them. How do you find out, and what do you change?
- It is 2am during a live incident and the incident commander asks you "is this ransomware?" You genuinely do not know yet. What do you say?