Submitting Disputes

If you believe a security event was incorrectly attributed to you, you can submit a dispute for review by your security team.

When to Dispute

Disputes are appropriate when:

• An event was attributed to you but was caused by someone else using your device
• A security tool generated a false positive (e.g., legitimate software flagged as malware)
• A phishing simulation was triggered by an automated process, not by you
• An event occurred during an authorized activity (e.g., security testing)

How to Submit a Dispute

1. Navigate to My Events in the Employee Portal
2. Find the event you want to dispute
3. Click the Dispute button
4. Select a reason category:
   • Not me (event attributed to wrong person)
   • False positive (legitimate activity flagged incorrectly)
   • Authorized activity (event occurred during approved testing)
   • Other (provide custom explanation)
5. Add a detailed explanation
6. Submit the dispute

What Happens Next

1. Review queued: Your dispute is added to the security team's review queue
2. Investigation: The security team reviews the event details and your explanation
3. Decision: The dispute is approved or rejected
4. Notification: You receive an email with the decision and explanation

If Approved

• The event is removed from your record
• Your score is recalculated without the disputed event
• The event is marked as "disputed — approved" in the audit log

If Rejected

• The event remains on your record
• Your score is unchanged
• The rejection reason is provided in the notification

Dispute Status

Track your dispute status in My Events:

• Pending: Awaiting security team review
• Under Review: Security team is investigating
• Approved: Dispute accepted, event removed
• Rejected: Dispute denied, event stands

Next Steps

• Understand your events
• View your security score
• Complete assigned training