Reporting & Evidence Automation
Learn how Cipherstep helps you catch suspicious user behavior and potential threat networks earlier, and spend less time preparing evidence for Suspicious Activity Reports (SARs).
Identify and remediate fraud while it’s still taking shape
A single session rarely explains an entire operation. When reporting is enabled for your workspace, background agents investigate completed 12-hour windows of mobile activity twice daily. They compare recent observations with historical context, looking for emerging patterns across accounts, devices, and networks—even in sessions that received an Allow decision.
Coordinated timing, concentrated account activity, unusual signal combinations, and changing network relationships can warrant a closer look. The investigation tests plausible benign explanations, such as a shared network or an app rollout, before presenting a concern. Each published report brings together the findings, supporting evidence, severity rating, and recommended next steps. Severity reflects the scope and urgency of the finding, separately from an individual session’s decision.
Analysts can review the investigation in the portal, download its Markdown, and use available CSV attachments to examine the affected activity. This reduces the work of assembling evidence for an internal case or a Suspicious Activity Report (SAR). Your team reviews the conclusions, adds its business and transaction context, and decides whether a SAR is required; Cipherstep does not automatically file one or take action against an account.
Analysis that keeps pace with your application
Your application’s traffic changes. A new release, a growing customer base, or a shift in how people use a protected flow can change what ordinary activity looks like. Each investigation uses a fresh snapshot of your workspace’s evidence alongside historical activity and prior findings, giving the reporting engine context to distinguish a new concern from a familiar pattern.
As you protect more workflows—from login to identity verification and checkout—the available device and runtime evidence broadens. We work with your team to scope reporting around those use cases. More eligible history gives investigations better comparisons; sparse data and gaps in collection are treated as limitations, rather than evidence that everything is safe.
This adaptation comes from the evidence available to each investigation and the platform’s evolving analysis. It does not require training a shared language model on your customers’ identities. New or materially changed findings can be examined against earlier investigations as user behavior and attack patterns develop.
Security & Compliance
The reporting agent operates in a sandboxed, read-only investigation environment. It can query approved evidence for the assigned workspace and snapshot. It cannot browse the internet, access another customer’s data, change a risk decision, or modify your policies. Tenant isolation and query permissions are enforced by the service, independently of the model’s instructions.
Direct account and network identifiers are replaced with tenant-scoped pseudonyms before reporting evidence reaches the model. Portal identities and optional user enrichment, such as email addresses, are excluded from those inputs. Where authorized, the export service can restore original account references for an analyst’s evidence download without sending those identifiers back to the model.
Before publication, the service checks evidence references, measured claims, severity, and attachments against the investigation’s snapshot. Model requests are configured to disable storage, gateway payload logging, and caching, with zero-data-retention requested for inference. These controls support your privacy and compliance processes; analysts still review the interpretation and retain responsibility for reporting and response.