Well, the cynic in me says that the incident report is not including a proper 'lessons learned' section. I know we do them for incident reports at my firm but what we release publicly and what we publish internally are usually dictated by the Legal team.