Being able to trace an incident backwards from breach to data source is vital in restoring and improving cybersecurity.