A $2.4M cyber claim just landed on your desk.
- MFA was enforced for all admin access
- API keys were rotated within 90-day policy
- Rate limiting was active at 500 req/sec
- AI bias monitoring was operational
- Model deployment was governance-attested
They provided logs, a SOC 2 report, and screenshots. Everything looks clean. Do you pay the $2.4M?
Or do you replay the cryptographic evidence first?
Replay failed at receipt #4.
HATS attempted to verify the Rate Limit Policy the policyholder claimed was active before the breach. The receipt hash does not match the governance chain. This policy was inserted after the incident to make it appear controls were in place.
Logs can be fabricated. Governance receipts cannot.
HATS doesn't ask whether logs look reasonable. It reconstructs the exact operational state from cryptographic evidence and rejects any history that cannot be independently reproduced.
For Insurers
Catch fabricated claims before payout. Mathematical proof, not forensic investigation.
For Regulators
Independently replay any organization's governance state at any historical timestamp.
For Legal
Evidence that authenticates itself. Tamper-evident. Vendor-independent. PQ-signed.
For CISOs
Prove your controls were genuinely active — not just logged. Replay-grade evidence survives litigation.