01 / Authority
Legal and ethical footing comes first.
Scope, authority, preservation, and cross-functional decision rights are established before evidence collection expands.
Boutique insider risk advisory
From evidence to clarity.
Gryphon Advisory helps security, legal, and people leaders investigate insider risk with disciplined attribution, calibrated confidence, and the integrity to stop where evidence stops.
The posture
Discipline when the stakes involve people.
02 / Evidence
Technical facts do not automatically identify a person.
Technical identification, investigative attribution, and legal attribution are kept distinct throughout the matter.
03 / Judgment
Non-attribution is a valid conclusion.
When the evidence cannot support person-level responsibility, the record should say so plainly and document why.
The STAAR lifecycle
A case is incomplete until the program learns.
Every engagement is designed to move from the initial trigger through a defensible decision and into practical program feedback.
0
Trigger & triage
Assess urgency, test innocent explanations, and preserve what matters without premature person-level conclusions.
1–2
Authority & evidence
Define scope, document compliance, then collect and preserve evidence with chain-of-custody discipline.
3–4
Analysis & interviews
Sequence the record, test alternatives, and use structured evidence disclosure rather than demeanor-based judgment.
5–6
Decision & feedback
Communicate calibrated confidence, implement corrective actions, and leave the program stronger than it began.
A clearer next step
Bring the trigger, the evidence, and the decisions ahead.
We begin by understanding the matter, the authority, and the organization’s risk—not by promising an answer before the record exists.