For practitioners
Choose a suspicious account, an alert, or an incident decision, then follow the most useful reading sequence.
First question: Is this a stolen password, a stolen session, an abused recovery path, or normal behavior that only looks unusual?
Use this route to frame the incident, identify missing evidence, and choose the next sign-in control to check.
First question: Which signal raised the alert, what alternative explanation fits, and what next check would change the decision?
Use this route to build a reasoned triage path instead of treating a score as a verdict.
First question: What boundary is exposed, what is actually known about impact, and who owns containment, recovery, and communication?
Use this route to define the exposed boundary, immediate decision, and response owner.
Useful across cases
Identity boundaries, explainable decisions, and financial-crime obligations often meet in the same case. These readings help when the immediate incident is only part of the problem.