Direct answer
A shared name is a candidate match, not an identity. Compare context and independently verified links, record conflicting evidence and leave the attribution unconfirmed if the available sources do not distinguish the subjects.
Describe the subject narrowly
Start with the organization's authorized question and the minimum known facts. 'Find public references to this company domain' is narrower than collecting all data about everyone with a similar name. Record the known domain or official website and the source of that knowledge.
Reference: NIST SP 800-115: Technical Security Testing.
Separate candidates
Two people can share a name, city or employer, and an organization can have a similarly named subsidiary or unrelated business. Keep separate records for each candidate until reliable evidence supports a relationship.
- Record the exact source and observation date.
- Avoid using one copied biography as multiple independent sources.
- Document inconsistent or missing evidence.
Check the direction of evidence
A profile claiming to work for a company is different from a company linking to that profile on a verified official page. Even an official link can be stale, so record when it was observed and whether the relationship is current.
Reference: NIST SP 800-115: Technical Security Testing.
Report the smallest supported conclusion
Say 'a public profile uses a matching name; ownership is unconfirmed' when that is all the evidence supports. Share only information necessary for the authorized decision, and use the organization's retention policy for supporting material.
Assessment limits
Public data can be copied, stale, impersonated or incomplete. No single name, image or location establishes identity or account control.
Frequently asked questions
Do the same name and city prove a match?
No. These details can be shared or copied. Seek independent corroboration appropriate to the purpose.
What if the official link is unavailable?
Mark the relationship unverified and identify what additional evidence would resolve it.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.