Measured outcomes with the method attached.
Anonymized customer evidence and aggregate operating results, presented with their source and measurement context.
A Tier 1 Residential REIT headquartered in Phoenix, Arizona
Executive evidence-chain preparation decreased from 6.5 hours to 42 minutes.
Methodology: Measured from Jira ticket creation to Investigation Matter Executive Brief export.
Operating results with context.
- Workspaces
- 114
- Active analysts
- 842
- Managed endpoints
- 1.2M
- Investigation Matters
- 18,400+
- Executive Briefs
- 3,100
- Entity-connection override rate
- 4.2%
- False-positive filter accuracy
- 88%
Jan 2024–Jun 15 2026 · Internal operational database and tenant analytics.
Accuracy varies in legacy proprietary environments. These are aggregate operating results, not guaranteed customer outcomes.
The Ghost Admin
Matter of Proof connected an unusual dormant-admin Okta login to PowerShell activity in CrowdStrike and a non-standard file transfer in Palo Alto logs. The incident involved potential exposure of PII for 12,000 customers.
The destination IP remained an unresolved confidence gap. A Lead Analyst verified it belonged to a former employee's home network, and the account was disabled 14 minutes after the alert.
The workflow saved an estimated four hours of manual cross-console correlation.
Bring us one investigation.
See how source-linked evidence and named human review work together.