Gray Zone Warfare · Part 5

Gray zone warfare part 5: Detection and attribution

Gray-zone evidence is scattered across systems. Detection matters when analysts can compose enough of it into a decision-grade assessment.

Originally published in 2024 · Substantially revised in 2026

Detection

Evidence is scattered across systems and institutions.

Gray-zone evidence is scattered across cyber logs, financial records, research ties, supply-chain data, influence activity, company filings, travel, procurement, and public reporting. Each source captures part of an event. Analysts compare actors, timing, and effects to test whether the events form a campaign.

Structural barriers

Monitoring is organized by vector.
Volume exceeds manual review capacity.
Classification, privacy, jurisdiction, commercial sensitivity, incompatible systems, and institutional incentives restrict exchange.

Recomposition

Compose enough evidence to assess a campaign.

Analysts need enough linked evidence to assess a campaign while preserving security, privacy, legal boundaries, source protection, and institutional ownership. Targeted access and traceable transformations link selected records without copying everything into one data lake.

Cybersecurity, finance, procurement, and intelligence systems record different parts of the activity. Analysts need relationships among their records, with identities reconciled and uncertainty preserved. Connecting data alone does not establish those relationships.

Six functions

Ingestion alone does not produce an assessment.

Ingest heterogeneous evidence

Tables, documents, network events, imagery, geospatial feeds, company records, sensors, open sources, and analyst notes encode events differently.

Resolve entities

Link references to the same person, organization, vessel, company, address, network, technology, or event.

Preserve provenance

Keep every significant claim traceable to its source and each transformation applied to it.

Detect relationships and anomalies

Distinguish observed relationships from inferred links and show the supporting evidence.

Maintain temporal context

Sequence reveals escalation, coordination, or enabling relationships that static summaries hide.

Support competing hypotheses

Show supporting, conflicting, and missing evidence, not only the leading explanation.

Reduce search burden without surrendering evidence discipline.

AI processes documents and imagery, resolves names across records, and surfaces candidate links for analyst review. Analysts verify sources and test whether each link supports attribution.

Design model interfaces so the organization can replace a model without rebuilding the evidence graph, access controls, evaluation process, or analyst workflow.

Attribution

A threat score is not an evidence chain.

Detection identifies activity; attribution links it to responsible actors at confidence suited to the decision. Attribution requires source-linked evidence and a defensible confidence judgment.

More collection adds cost, noise, and exposure. Detection matters when analysts connect sources, test alternatives, and route an assessment to an authorized decision-maker before the response window closes.