3 · Investigative

“Who is behind this series of events?” Trust and safety, fraud and threat-intelligence teams.

Evidence standard: Corroborated signals with provenance and a report another analyst can reproduce.
Cost of a wrong call: Months of an investigation pointed at the wrong actor.

What it can and cannot claim

Can claim

These events share these observed features, from these independent sources, recorded at these times.
Our assessment, stated as an assessment with its confidence, of how likely they share an operator.

Cannot claim

A named individual or company, from technical signals alone.
Intent. Signals describe behavior, not motive.
Independence for two signals that come from the same upstream source.

Error rates

Silvector publishes no measured detection error rate for this rung yet. Any number you see elsewhere on this site is labeled with its source, and none of them are ours. Corroboration only reduces error when the signal families fail independently; the report has to show why they do.

A valid error-rate statement at this rung includes:

Each contributing signal's error rate, and why the families are independent.
How an analyst can rerun the correlation from the stored receipts.

Bias risks

Shared infrastructure (a cloud region, a VPN exit, a university network) makes unrelated people look linked.
Confirmation bias: once a suspect exists, ambiguous signals start to fit.

What Silvector has at this rung

Capability	State	Where
Receipt hash chain (`prev`), per tenant stream within one Worker isolate	shipped	`packages/engine/src/receipt.ts, apps/api/src/store.ts`
Transparency log with inclusion and consistency checks: the library ships; the published head adds recent receipt hashes to four placeholder leaves in a per-data-center cache, best effort, up to 64 leaves, with no inclusion check for a receipt	planned	`packages/transparency, GET /.well-known/transparency`
Replay of recorded traffic through a policy	shipped	`apps/replay, packages/engine/src/receipt.ts replay()`
A corroborated-finding record with two or more signal families and provenance	planned	`Lane A, AG4-400`

How to escalate

To reach Rung 4 · Forensic:

Show lineage across at least two sessions, accounts or pieces of infrastructure.
Content-hash every artifact and start a custody log (rung 4).

Previous: Rung 2 · Operational · Next: Rung 4 · Forensic · The whole continuum