Comment by thayne

CT logs only tell you something happened if the certificate was registered in the log. But if you are attacking software that doesn't check if the cert was registered, then you don't need to register the cert, and there won't be anything in the log.

My point is you can forge a cert, without putting it in the log, and a lot of software will still be vulnerable to it.