Sample record · Cyber · incident response

A helpdesk agent stops a social-engineering run

An IT helpdesk agent receives 14 password and MFA reset requests in six minutes, pauses all of them and escalates. The analyst confirms the attack and reports it to the insurer's breach hotline.

Fictional scenario, real seals. No company, person or transaction here is real. Each record was sealed on Verdict’s public sandbox and logged on Sigstore Rekor, a public log Verdict does not run. This chain was sealed in one sitting, so its log times are seconds apart; in a live deployment each step is logged when it happens.
What the log time settles in a real case

When the attack was detected and when it was reported. Breach-notice clocks run from those moments.

  1. Step 1 of 2 · Helpdesk AI pauses 14 resetsAwaiting human review

    Agent detects the pattern (same phrasing, new devices, out-of-hours, finance and payroll staff targeted), pauses all 14 resets instead of completing them, and escalates to the security operations analyst on call.

    Logged on Rekor
    2026-10-14 23:31:33 UTC
    Log index
    3256366419
    Record id
    ser_892dd8d5bb7ce66553c3093f97f16296
    Verify in your browser →Open the Rekor entry ↗Download the record
  2. Step 2 of 2 · Security analyst confirms and reportsHuman approved

    Analyst (fictional) confirms an automated social-engineering run, keeps all 14 resets blocked, blocks the source addresses and opens an incident with the insurer's breach hotline within 40 minutes. Reason recorded: no employee confirmed any request by callback.

    Logged on Rekor
    2026-10-14 23:31:36 UTC
    Log index
    3256366983
    Record id
    ser_53bd2ee9d03ff8c29794a68f8ebd0c54
    Verify in your browser →Open the Rekor entry ↗Download the record

How to check the time yourself. Open the Rekor entry and compare its logged hash with the SHA-256 of the record’s commitment, which the verifier shows. If they match, the entry’s integrated time is the earliest moment this content is proven to have existed. Log times above were read from Rekor on 2026-10-15.

A record proves what it says has not changed since it was logged. It does not prove the event happened as described, or who made the record. What Verdict proves, and what it doesn’t →

All sample records →