What is an evidence layer in cybersecurity?
An evidence layer is the part of security that proves what happened. Most security tools protect (antivirus, firewalls), detect (alerts and monitoring), set rules (policies and audits) or predict (threat intelligence). All of them assume someone kept an honest record of what actually took place, yet on most personal computers nobody does. An evidence layer keeps that record: written at the time, sealed so any later change shows, kept where the person who might want to alter it cannot quietly do so, and readable by the owner. Aircraft have carried one for decades in the flight data recorder. Alcyone Secure uses the term for what its free app, Rashnova, does for Windows PCs.
Why a record changes the outcome
Most disputes about a device come down to one word against another. A customer says files were copied during a repair; the shop says they were not. An employee says they never opened a folder; a manager says they did. Without a record made at the time, nobody can settle it, and the honest party loses as often as the dishonest one.
Antivirus does not help, because nothing malicious ran: a person with legitimate access simply did something they should not have. That is the gap an evidence layer fills.
What makes a record trustworthy
It is written when the event happens, not reconstructed later. It is sealed, so that changing or removing an entry leaves a visible break. It is kept somewhere the person who might want to change it cannot quietly reach. It is honest about its own gaps, saying when it was not running rather than presenting silence as proof that nothing happened. And it records what was done, not what was inside: the fact that a file was copied, not the file.
Where the idea comes from
Every field with serious stakes learned this lesson, usually after an inquiry. Aviation's flight data recorder dates from the 1950s and became required on US aircraft from 1958. Rail event recorders and ships' voyage data recorders followed, the latter required by the SOLAS convention from 2002. Personal computers, which now hold our documents, photos and identities, never got an equivalent.
Rashnova is Alcyone Secure's evidence layer for Windows. It is free, keeps its sealed record on the owner's computer, never records the screen, keystrokes or file contents, and turns a repair visit into one report with Repair Mode.