Data sources
- Web server access logs
- Page-level behaviour beacons served from the protected site itself
- Network ownership and routing registries
- Customer-maintained lists of known actors
Capability
Counter-reconnaissance and behavioural detection
Recognise the preparation before the attack: systematic enumeration, scheduled sweeps of many properties by one source, returning observers and automation presenting as people.
Available in current prototype
In operation across independent web servers: visit reconstruction, network classification, returning-observer detection and plain-language reporting.
Operational problem
The problem
Hostile activity rarely begins with an exploit. It begins with looking: mapping which sites and services exist, which pages reveal people and structure, which documents are reachable, and when the defenders are paying attention. Signature-based tools treat each request on its own and see nothing unusual in a polite visitor who returns every three days to read the same pages.
Workflow
How it works
- Every finished visit is reconstructed per source: pages in order, time on each, media actually played, documents opened, and how the visitor arrived.
- Sources are classified by network type — hosting, anonymising services, corporate gateways, public-sector networks, residential and mobile access — before any judgement is made about intent.
- Behaviour is compared with the source's own history and with every other source: the same reading pattern across many properties, the same interval between returns, the same document reached from different networks.
- A finding is reported in plain language with the evidence beneath it. Concealment is respected: a watched source is never tipped off by an automatic block.
Actionable outputs
- Per-visit reconstructions
- Pattern reports for sources that sweep, return or read selectively
- Range proposals for operator decision
- Evidence attached to each finding
Trust boundary
Observation is limited to infrastructure the customer operates. Nothing is collected from the visitor's device beyond what the customer's own website receives, and no external system is probed.
Benefit
Early warning measured in days, not in the minutes after an intrusion — and a record of who was watching when the question is asked later.
Related
Other capabilities
- Threat hunting and historical investigation Available in current prototype
- Intelligence fusion and relationship discovery Available in current prototype
- Attack-path and exposure analysis Available in current prototype
- Active defence and controlled interdiction Available in current prototype
- Forensics, evidence integrity and reporting Available in current prototype
- Sensor reliability, tamper detection and operational health Available in current prototype
SOVEREIGN BY DESIGN.
Discuss this capability
Tell us what you need to protect. A briefing is an engineering conversation; it never needs your credentials, network inventories or logs.