Build the case before you make the call.
Matter of Proof assembles alerts, identity events, endpoint telemetry, and cloud activity into an evidence-linked investigation matter—so analysts can review what happened, what supports it, what remains uncertain, and what should happen next.
AI-assisted. Source-linked. Human-approved.
Improbable travel followed by finance file access
- 09:02First sign-in succeeds from the expected location
- 09:18Second sign-in succeeds from a second country
- 09:21Finance file share accessed, followed by the outbound session
- user · a.reyes (sample account)
- host · wks-1042
- asset · finance file share
- network · 203.0.113.24 (documentation range)
Basis: two sign-ins separated by an infeasible distance, corroborated by a file-share audit record. Reduced by one contradictory endpoint record that places the registered device asleep.
Was the outbound session initiated by the same account, or by a scheduled backup job on the same subnet?
AI may collect, correlate, summarize, score confidence, and draft; every matter receives human review; AI cannot close critical matters alone.
- Source-linked
- Every claim carries the system and record it came from.
- Confidence stated
- An assessment that states the basis it rests on.
- Uncertainty visible
- Unresolved questions and contradictory evidence stay on the page.
- Human-approved
- High-impact steps wait for a named analyst to approve them.
- 112 min → 28 min mean review time
- 18,400+ Investigation Matters
- 100% human review
Aggregate platform results · Jan 2024–Jun 15 2026 · Internal operational database and tenant analytics.
Evidence before conclusion. Sequence before noise.
- 01StepCollect the record
Alerts, identity events and telemetry are collected from your SIEM, EDR, identity provider and cloud control plane into one Matter, each row keeping its source reference.
- 02StepReconstruct the matter
Entities are connected and the sequence rebuilt, with known facts, contradictory evidence and unresolved questions kept apart.
- 03StepApprove the next step
Recommended next steps reach a named analyst with confidence stated. A human approves, and the approval history stays on the record.
Anatomy of an Investigation Matter.
A Matter is one connected record. It holds the evidence, the sequence, the uncertainty and the decision — in a form that survives review months later.
- Evidence index
- Every claim is a numbered row with its source system, record reference and collection time.
- Connected entities
- Accounts, hosts, assets and network endpoints linked across the systems that hold the record.
- Reconstructed timeline
- Events placed in sequence, with gaps left visible rather than smoothed over.
- Confidence with a basis
- A stated assessment, the evidence it rests on, and what would change it.
- Known, unresolved, contradictory
- Kept apart so a reviewer can see what is settled and what is not.
- Approval history
- Recommended steps, the named analyst who approved them, and an immutable record of the decision.
The path between entities, with every step cited.
Entities are connected into a readable path rather than a decorative map. Each connection names the record that supports it, and a step with no supporting record is shown as an open question instead of a line.
See the investigation workflow- 01Identity
A sign-in is accepted, and the session it created is recorded with the source event.
- 02Endpoint
Process and device records are placed against that session, including the ones that contradict it.
- 03Cloud
Access to data and control-plane activity is connected to the same principal and time window.
- 04Network
Outbound sessions are attached where a flow record supports the link, and left open where none does.
No response leaves without a named approval.
Recommended next steps are drafted with their supporting evidence attached and their uncertainty stated. A named analyst approves, requests more evidence, or rejects — and the decision stays on the record.
AI may collect, correlate, summarize, score confidence, and draft; every matter receives human review; AI cannot close critical matters alone.
Connected to the systems that hold the record.
Uncertainty made visible. Human authority preserved.
Containment and identity actions wait for a named analyst; the approval stays on the record.
Every recommendation cites the alert, log line and identity event it rests on.
An unbroken account of who decided what, when, and on which evidence.
Integrations request the minimum scopes needed — and we publish what we ask for.
Run Matter of Proof in observe-only mode for the first weeks, with no write access.
One connected investigation record.
Every alert opens as a Matter with its source evidence collected and a confidence an analyst can defend in review.
Learn moreRun a multi-tenant queue with per-client policy, role scoping and client-ready executive briefs from the same record.
Learn moreReconstruct impossible travel, MFA fatigue, OAuth grant abuse and session hijack across identity providers in one Matter.
Learn moreProcess trees, parent-child chains and outbound sessions connected to detection signals, with open questions stated.
Learn moreEvery alert, decision and approved action is documented against SOC 2, ISO 27001, PCI and NIST CSF controls.
Learn moreA brief a CISO can send — impact, scope, what is known, what remains unresolved — drafted from the Matter for review.
Learn more
A brief a leader can read, and defend.
Impact, scope, what is known, what remains unresolved, and the actions approved — drafted from the Matter and prepared for review before it is sent.
See the investigation workflowPlans sized to the matters you open.
Custom volume, SSO/SAML, and residency controls
99.9% uptime commitment
Scope Enterprise ReviewSave 15% with annual upfront billing
Bring one investigation. Leave with the evidence organized.
Matter of Proof connects to the systems you already run, builds the Matter, and waits for a named human to approve what happens next.
- An evidence index with every source reference kept
- A reconstructed sequence with the gaps still visible
- A confidence assessment and the basis behind it
- The unresolved questions, written down
- A recommended next step awaiting a named approval