Four capabilities. One investigation.
OopsieMarbles collects external intelligence, connects it into a graph, explains what the connections mean, and hands an analyst something they can act on. Everything below is a different view of that same loop.
What the platform does.
Discovery
Collect external intelligence from hundreds of public and restricted sources, then attribute what you find back to the organisation it belongs to.
Investigations
Group related evidence into a single workstream. A case turns a pile of independent alerts into something a person can actually follow.
Exposure graph
Nodes are marbles. Edges are relationships. Confidence grows as independent evidence converges.
AI analyst
Summarise evidence, explain relationships, recommend next steps, and flag what is still uncertain. Analysts make the decisions.
What we look at.
The same evidence model applies across every source. These are the four areas most teams start with.
Identity
People, aliases, credentials and the artifacts that link them. Scored, tracked over time.
Infrastructure
Domains, subdomains, hosts and certificates, including the ones nobody remembers registering.
Monitoring
Continuous re-checks. You hear from us when something changes, not when something exists.
Reports
Scheduled summaries for the people who were not in the investigation.
The graph is not the product.
The graph is how reality looks when evidence is connected. Its purpose is explanation, not visualisation.
More evidence. Less guessing.
We don't promise perfect visibility. We promise better understanding.