Correlation means two measured factors vary together; causation means a change in one factor produces a change in the other. A correlation alone cannot show which factor came first or rule out other explanations, such as differences between groups, outside influences, or measurement gaps.
In cyber security, telemetry may show that a behavior-such as unusual application switching-coincides with an event, but that does not prove it caused the event. Analysts use additional evidence, controlled comparisons, and investigation of alternative explanations before drawing causal conclusions. The same caution applies to workplace activity data: a link between AI use and longer workdays does not establish that AI caused those longer hours.