Triage is a decision under uncertainty

You can prioritize an investigation without pretending its cause is known.

Separate confidence and consequence

Triage is an initial assessment of a potential incident’s priority, scope, and next handling. Confidence describes how strongly evidence supports an explanation. Potential impact describes what could matter if that explanation is correct. Low certainty does not always justify low urgency.

Assume a fictional grants office handles private application records. Its policy requires review within sixty minutes of recognizing an unexpected sensitive-data export combined with an unresolved account alert. These records concern one account, but do not identify its human operator.

Supplied observation packet

• T1: A sign-in alert reports a region unusual for analyst Dana’s account.
• T2: Dana has approved travel to that region. Network location is approximate; device confirmation is pending.
• T3: The same session exported an application report outside the usual reporting window. The export is recorded as completed, but its business authorization is unconfirmed.

Keep both explanations visible

Legitimate travel and an authorized urgent report could explain the observations. Account misuse could also explain them. T2 reduces the surprise of the region but does not establish who used this session or whether this export was approved.

Request the report owner’s confirmation of purpose and scope through established contact channels, along with available session and managed-device context. Preserve the completed-export record and its relationship to the session. Record when the combined condition was recognized and set the sixty-minute deadline from that moment.

Do not convert “authorization unconfirmed” into “data stolen.” Equally, do not discard T3 because another signal has a plausible explanation.

Model status: Sensitive export under review; misuse unconfirmed. Travel is relevant context, and session ownership and export purpose remain unresolved.