Evidence Methodology

Every decision points back to evidence.

SynapseThreat separates what was observed from what was inferred.

Relationships, assessments, and test outcomes retain the source, time window, method, supporting evidence, and contradictory evidence required to understand the conclusion.

01 / OPERATING PRINCIPLES

Five principles govern every finding.

Evidence-backed
Every conclusion can be traced to the observations that support it.
Time-aware
Relationships and assessments state when they were observed and valid.
Contradiction-preserving
Conflicting evidence remains visible rather than being silently discarded.
Authorized
Authorized cybercrime red team tests are bound to an approved target and scope.
Reproducible
Expected and observed outcomes are retained together for every authorized test.
02 / THE VOCABULARY

Observed is not inferred. Inferred is not validated.

These are customer-facing statements about how a conclusion earned its place. Each finding carries the strongest state its evidence supports, and no more.

Observed
Recorded directly from a source at a stated time: a page render, a session, a transaction, an on-chain event.
Derived
Computed from observations by a stated method: an extracted feature, a similarity measure, a normalized value.
Correlated
Two or more observations linked by shared evidence: time, infrastructure, device, or behavior. The basis of the link is stated.
Inferred
A conclusion reasoned from evidence rather than directly recorded. Inference is labeled as inference.
Predicted
A forward-looking statement carrying its time horizon and the evidence behind it.
Externally corroborated
Confirmed by an independent source outside our own collection.
Analyst reviewed
A person examined the evidence chain and endorsed or annotated the conclusion.
Validated
Expected and observed outcomes were compared under an authorized plan, and the result supports the conclusion.
Contradicted
Credible evidence points the other way. The conflict stays visible until the stronger basis is established.
Retracted
The conclusion was withdrawn: a source failed, a method erred, or superseding evidence arrived. The retraction is recorded.
Expired
The validity window closed. Expired conclusions stop working; they are not quietly carried forward.

SynapseThreat does not sort the world into malicious and benign. A finding carries the state its evidence supports. A missing match is not a benign verdict.

03 / CLAIM DISCIPLINE

The sentences we hold ourselves to.

Standing rules
  • Similarity is not identity.
  • Shared infrastructure is not operator attribution.
  • Correlation is not proof.
  • A prediction has a time horizon.
  • A conclusion can expire.
  • Counterevidence remains visible.

Campaign mapping and relationship intelligence tell you how an operation moves. They are not claims about who the operator is. SynapseThreat uses a behavior-based methodology informed by the MITRE Fight Fraud Framework.

04 / IN PRACTICE

What this buys you in a decision.

When a finding says a defense question deserves investigation, you can see the observations underneath it, when they were valid, what corroborates them, and what cuts against them.

That is the difference between acting on an alert and acting on an understanding.

Mission: Account Takeover Mission: Platform Abuse Mission: Loyalty Abuse Test: Cybercrime Red Team

08 / Briefing

Bring us the cybercrime operation your current tools cannot fully explain.

Request a briefing to examine an account takeover, platform abuse, or loyalty abuse operation, or to test your defenses with a cybercrime red team engagement.

Direct: [email protected]

Required when Cybercrime Red Team is selected.
Optional.
Briefing request received. We will respond within one business day.

By submitting this form, you agree that SynapseThreat may use the information to respond to your request. See Privacy & Cookies.