How should I present uncertainty in cloud attribution?¶

Attach uncertainty to the exact link that remains unresolved. An account may be conclusively identified while the device link is moderate and the person using it cannot be determined; those are different propositions and should not be blended into one confidence statement.

Show the attribution layers¶

Set out what the provider established about the account, session, application, device record and connection. Then explain the evidence linking each technical element to the next and ultimately to a person.

Test realistic alternatives such as account sharing, compromise, stolen tokens, delegated applications, automation, remote access, shared networks and multiple devices. State which evidence supports or weakens each, and say directly where two explanations cannot be distinguished.

Use calibrated, reasoned language¶

Terms such as records, is consistent with, supports, likely, cannot exclude and cannot determine can express different evidential positions when their basis is explained. Avoid unsupported percentages or vague caution that obscures a strong technical finding.

Acknowledging a defined uncertainty does not weaken unrelated parts of the reconstruction. It shows that attribution was tested rather than assumed and allows reviewers to understand its real weight.

Present the strongest justified conclusion at each layer, not a decisive-sounding summary that silently transfers certainty from the account to the person.