What does cyber attribution identity in an investigation?

Identifying the cause of an attack is part of incident analysis, but attribution specifically identifies who is responsible.

Identifying the exploit of an attack describes the method used, not the identity of the attacker.

Identifying vulnerabilities exploited explains how the attack succeeded, not who carried it out.

Cyber attribution is the process of tracing the identity of the perpetrator or threat actor behind a cyberattack or intrusion, often seeking to determine individuals, groups, or nation-states.