01
Technical identification
What acted: a device, account, session, artifact, or system event.
Our approach
People. Evidence. Better decisions.
Gryphon Advisory is built for the hard middle of insider risk: where a signal matters, trust is involved, and a poorly supported conclusion can create more risk than the incident itself.
Standing principle
Evidence over assumptions.
The practice maintains a disciplined separation between what digital evidence shows, what can responsibly be inferred about an individual, and what remains for a legal or employment process to determine. That distinction protects both the organization and the people involved.
A conclusion of non-attribution is not a failure of the process. It is often the most honest and useful outcome the evidence allows.
Calibrated clarity
Three ideas that should never be conflated.
02
Investigative attribution
Who is most likely responsible after converged evidence and alternative explanations are tested.
03
Legal attribution
A determination reserved for the appropriate adjudicator, tribunal, or authority.
A counsel-friendly approach to a complex risk.
Start with the matter, the facts currently available, and the decision-makers who need to be involved.
Contact Gryphon Advisory