Wrong claim
Why it feels true
“Impossible travel for jordan.h” is short enough to paste into a payroll email.
Precise correction
NIST SP 800-61 Revision 3 (final 3 April 2025) treats incident response as work that records facts and preserves evidence, not as a title copied from a detector.
The title is a bet that a person should look.
The fact Maya can quote is the identity-provider success log, with its time and source. Human guilt, data theft, and “Jordan did it” stay hypotheses until a record supports them.
MINI-CHECK