A null result is an outcome in which a test does not detect the signal it was looking for. In cyber security, this can happen when an intrusion detection rule, malware scan, port probe, or threat-hunting query returns no match. That does not automatically mean nothing is there; it may mean the attack was absent, hidden, blocked, or below the detection threshold.
Null results matter because they help security teams rule out hypotheses and tighten limits on what is happening in a system. For defenders, a null result can confirm that a control is filtering traffic, a signature is too narrow, or telemetry is incomplete. In attacks, adversaries may aim to create null results by reducing noise, evading signatures, or blending into normal activity. In both cases, the absence of a detection is a useful technical finding, not just a blank outcome.