Threat intelligence you can check

Our story

We watched. Then we built the membrane.

We presented ourselves to the open internet as a diffuse, unprotected target, and recorded what came at us: scanners, scrapers, poisoned packages, bots wearing AI-assistant names, and agents that obey whatever they read. Every hit became a rule. The rules became the membrane: a human decision on everything irreversible, automation on everything else, and a receipt for both.

We built it for ourselves first, because we couldn’t find anyone building AI security at the layers where an agent needs a human gate. No AI washing: optimized for Claude, and your contexts stay portable.

01. Watched

Background radiation, measured.

02. Learned

Every hit became a rule.

03. Built the membrane

Human gates where decisions are irreversible. See the membrane.

04. Proved it cheap

We publish what our gates cost us and what skipping them cost; FinOps meters the rest.

The moat

Four things a bigger vendor structurally can't copy by writing a check.

The incumbents are optimized to protect the customers they already have. We're optimized for the thing that actually wins: getting to a true, defensible call faster and cheaper than the attack it stops.

01. Novelty, measured

Most of the indicators we publish are not in ThreatFox. We measure it weekly and publish the number: not a slogan, a metric you can check.

02. Receipts, timestamped

We've named breaches in our public archive before the vendor advisories landed — with the comparator timestamp attached. Anyone can read the post and check the date. Lead time you can audit beats confidence you can't.

03. Cost asymmetry

We engineer the cost of producing a detection below the cost of the attack it defeats. That's why a $0–10K defender can run intelligence that used to require an enterprise contract.

04. AI-native, from the metal

The platform was built AI-first, not bolted on. That pace is a strength, not a dependency — every published call is human-reviewed, and the whole pipeline is instrumented to catch its own mistakes (we cap and kill abusers of our own feed, publicly and honestly).

Straight talk

How we're different from the name-brand feed.

Sells you its conclusions.

Shows you the receipt — indicator, source, and the timestamp.

Resells indicators everyone already has.

Publishes the indicators the common feeds don't carry, measured weekly.

Priced for the Fortune 500.

Priced so a small team can act — free tier included.

Reports vanity volume.

Reports the honest number, even when it's smaller.

No funding · Two people · Receipts

Where we kick ass — and how you'd check it.

No venture capital. No Series A. Two people on a budget you'd mistake for a rounding error. That's not the apology — it's the point. Every claim below comes with something public you can verify.

01. We watched. Then we built the membrane.

We stood on the open internet and recorded what came at us: scanners, poisoned packages, bots wearing AI-assistant names, agents that obey whatever they read. Every hit became a rule. A person decides everything irreversible, automation handles the rest, and both leave a receipt. Open the membrane.

02. We publish what the feeds don't

The indicators we source independently (supply-chain hunts, honeypot hits, research imports, bulletproof-ASN maps, malicious packages, brand-impersonation GitHub repos) are checked against ThreatFox every week, by stratum, at a public endpoint. A query, not a slide.

03. We race CISA to the KEV, in public

When we and CISA land on the same exploited vulnerability, the KEV-lead ledger records both timestamps: the leads, the ties and the misses. We don't lead every time, and the ledger says so. When we do lead, it's the days a defender uses to close the door.

04. Real scale, hobby budget

A free STIX 2.1 feed plus a searchable research corpus (live counts). Roughly $500–600 a month of cloud. Two people.

05. Compliance, stated plainly

No SOC 2 report yet, and none can be self-assessed. The evidence an auditor asks for is already kept (4,017 files and counting), so we estimate an audit as a modest investment, not a rebuild. We score our own readiness with the 95% cap and publish the gaps.

06. Why no funding is the flex

We don't out-spend CrowdStrike; we engineer the cost of a detection below the cost of the attack it defeats — with zero outside money. A company that needs a war chest to make the math work has a fragility we don't. The lean team is what produced all of the above.

One platform

Everything under one roof — not a shelf of half-products.

Search, distribute, correlate, and defend from a single source of truth.

STIX / TAXII feed

Live indicator records, updated continuously, with Splunk ES, OPNsense, Suricata, and DNS-sinkhole plugins. Pull it into what you already run.

Jeevesus graph

Cross-correlate an indicator across the whole corpus of documents — IOCs, actors, CVEs, and our own predictive coverage — through one hybrid search.

Edge Shield

A Cloudflare Worker that enforces our high-confidence blocklist at your edge, before traffic ever reaches your origin. Free key: daily refresh. Hourly: Shield $24/mo. Set it up with Claude Code →

AIPM

See and fix how AI assistants describe your brand — the new front page nobody's watching.

See it work

Live tools & visualizations — the receipts you can click.

Not screenshots, not a demo request — the actual production surfaces, open to anyone, no key required. Toys and tools are how you demonstrate command of a topic instead of claiming it.

A breach breaks. Our analysis is already published — timestamped, before the news, with the receipts.