# Cyber Attribution **Domain:** Cybersecurity / Intelligence / Digital Forensics **Doc Type:** Canonical Practice Node **Maturity:** Foundational ## Definition **Cyber attribution** assesses who is responsible for a cyber operation by combining technical artifacts, infrastructure, behavior, intelligence, motive, access and operational context. ## Evidence Context Attribution is probabilistic and layered. Identifying malware, infrastructure or an intermediary does not automatically identify the directing actor. Strong conclusions require converging evidence and explicit confidence. ## See Also [[wiki/Digital Forensics|Digital Forensics]], [[wiki/Advanced Persistent Threat|Advanced Persistent Threat]], [[wiki/Concealed Causation|Concealed Causation]], [[wiki/Provenance|Provenance]]