Data sources
- Per-host visit histories
- Network ownership records
- Customer-held actor files
- Customer-authorised external feeds, requested directly
Capability
Intelligence fusion and relationship discovery
Join observations that no single log connects: different networks, different servers, different weeks — linked by what they share, each link carrying its own confidence.
Available in current prototype
One consolidated report assembled from independent servers, each answering only to the operator's own collector.
Operational problem
The problem
A determined observer changes networks. Each server sees a stranger; only the combined record shows one actor. Correlation is also where false accusation begins, so every link must show why it exists and how strong it is.
Workflow
How it works
- Each protected server keeps its own history; correlation happens inside the customer's domain, on the customer's side, by pulling records over restricted channels the customer initiates.
- Links are formed from shared referral context, shared documents, network ownership, device characteristics, page selection and timing.
- Every link is graded and every graph keeps its alternative explanations — shared corporate gateways, public Wi-Fi, coincidence.
- Analysts confirm or reject; nothing is promoted to a conclusion automatically.
Actionable outputs
- Relationship graphs with confidence
- Actor profiles built only from the customer's own evidence
- Consolidated reports across servers
Trust boundary
Fusion never leaves the customer's infrastructure. Remote sensors hold no outgoing credentials; the consolidating side pulls, over keys pinned to its own address.
Benefit
One actor recognised as one actor — with the reasoning visible and challengeable.
Related
Other capabilities
- Counter-reconnaissance and behavioural detection Available in current prototype
- Threat hunting and historical investigation Available in current prototype
- Attack-path and exposure analysis Available in current prototype
- Active defence and controlled interdiction Available in current prototype
- Forensics, evidence integrity and reporting Available in current prototype
- Sensor reliability, tamper detection and operational health Available in current prototype
SOVEREIGN BY DESIGN.
Discuss this capability
Tell us what you need to protect. A briefing is an engineering conversation; it never needs your credentials, network inventories or logs.