ACCOUNT TAKEOVER EVALUATION
Add context to login and recovery decisions.
Review a synthetic login or account-recovery interaction without treating one unusual signal as proof of compromise. The workflow keeps available, missing, and unavailable evidence visible before your application chooses what happens next.
Evaluate the interaction, not a permanent label.
Interaction
Evidence
Policy
Mark the consequential interaction.
Input: a bounded login or recovery event
Inspect what is known and what is not.
Output: assessment context with evidence state
Apply your recovery and access policy.
Decision: owned and recorded by your application
Absence is not the same as safety.
Evidence present
A supported input contributed context.
Evidence missing
An expected input was not supplied.
Evidence unavailable
A check could not produce a result.
Suspicious context still needs an explanation.
A new device, network change, or automated pattern does not by itself prove compromise.
Walk through one login or recovery decision.
Bring the interaction, current controls, evidence gaps, and policy owner. The walkthrough stays scoped to the workflow instead of promising an outcome before evaluation.