// case disambiguation
compare case types
practitioners often investigate cases that look like two things at once. these pairs show side-by-side primary tools, editorial overlap, and signals to lean toward one case type over the other — all derived from the case-type taxonomy.
common comparison pairs
pick a pair to see primary tools, shared editorial mappings, and disambiguation guidance.
- BEC vs account takeoverboth show mailbox rules and login telemetry — but BEC is social-engineering fraud; ATO is credential compromise that may escalate into fraud.BEC · ATO
- ransomware vs BECboth can hit finance and email — but ransomware leaves encryption and lateral-movement artifacts; BEC is wire fraud via impersonated threads.ransomware · BEC
- stalkerware vs cyberstalkingboth involve unwanted surveillance — stalkerware is a covert app on-device; cyberstalking is broader harassment across accounts and platforms.stalkerware · cyberstalking
- cloud compromise vs ATOboth surface in identity and mailbox logs — cloud compromise is tenant-scoped OAuth and policy abuse; ATO is single-account credential takeover.cloud ATO · ATO
- insider threat vs disgruntled exitboth involve a departing employee — but insider threat is sustained access-anomaly and exfiltration; disgruntled exit is last-day endpoint sabotage and deletion bursts.insider threat · exit triage
- phishing campaign vs BECboth start in the inbox — but phishing is org-wide lure infrastructure and IOC pivoting; BEC is targeted impersonation for wire fraud or payroll redirect.phishing · BEC
- crypto theft vs pig butcheringboth end in a drained wallet — but crypto theft is approve-for-all phishing or sweeper bots; pig butchering is weeks of chat grooming through a fake exchange.crypto theft · pig butchering
- sextortion vs cyberstalkingboth involve targeted harassment — but sextortion is payment demand tied to intimate imagery; cyberstalking is broader multi-platform surveillance and impersonation.sextortion · cyberstalking