Castle: impossible-travel login flagged (medium → high after Sift corroboration)
Login from Berlin 09:14 UTC + login from San Francisco 09:32 UTC. Castle ATO probability 0.81. Sift cross-correlation confirmed credential reuse. Recommended: step-up auth on next sensitive action.