Well this went off-script quickly!
As soon as Sir Mark Sedwill was appointed by the PM as the leak investigator it set in chain the usual business of removing Number 10, the Cabinet Office and the NSC chair as entities for suspicion or investigation. Quite handy when you know they leak as a matter of routine.
Sir Mark's list of suspects was now contained to the intelligence agencies themselves (highly unlikely and outside of his gift) so effectively he had to pick either the Home Sec or Defence Sec. Even if he wanted too, picking the Home Office would have triggered a Met Police investigation as they would have undoubted primacy.
As the PM knew, Sir Mark managed to pull a fast one on Gavin Williamson when he deleted the MoD from the Defence Review, chairing it himself as the NSC. When this started to unravel Williamson dug the knife into Sir Mark and a separate MoD orchestrated 'Defence Modernisation Review' was split away from the NSC chair. More dummies were spat.
But as the PM knew, the normal politics would kick-in: The Defence Secretary would be asked to resign and he would dutifully accept responsibility for an 'inadvertent error' and everyone would agree that it was all a big mistake with no real consequences and no need for the Met Police as everything has been resolved.
With Gavin Williamson issuing a flat denial and positively courting a police investigation it has all gone tits-up. The PM cannot claim that the matter is closed as, effectively, there is a counter claim that somebody else leaked the information and has managed to evade the first investigation - effectively a criminal matter. Equally, Williamson has surrendered the 'inadvertent error' political defence and is equally liable for a criminal investigation.
With so many senior politicians chalking this up as a major security breach it is difficult to see how the PM can avoid a police investigation. Nobody has admitted an error and nobody is accepting the blame.