Nodes are marbles. Edges are relationships.
A marble on its own rarely explains anything. The graph is what the same evidence looks like once the relationships between the pieces are drawn in.
Unmanaged VPN host answering on a corporate subdomain
4d agoSubdomain takeover candidate on a dangling CNAME
5d agoLive API key committed to a public repository
6d agoContractor account active after offboarding
9d agoEmployee résumé listing internal tooling and versions
11d agoNetwork diagram published on a public wiki
12d agoInternal invite link indexed by a search engine
18d agoEvery artifact says how it got there.
The category is the difference between "we found this" and "we believe this". It is shown on the node itself, not buried in a detail panel.
- Primary
- A confirmed anchor for this identity. Directly observed, not inferred.
- Correlated
- Linked by inference. Plausible, not yet independently confirmed.
- Breach
- Surfaced from a credential dump or breach corpus.
- Shared
- Also attributed to a different subject — often the most interesting edge on the board.
Convergence, not assertion.
One source is a lead
A single observation is enough to look, not enough to act. We show it, and we show that it is alone.
Independent sources raise it
Confidence rises when sources that could not have copied each other agree. Two feeds derived from the same dump are one source.
Confidence can fall
When a host stops answering or a credential is rotated, the score moves down. Scores that only ever go up are not scores.
Everything is traceable
Any number on the platform can be opened to the evidence that produced it. If we cannot show our working, we do not show the number.
More evidence. Less guessing.
We don't promise perfect visibility. We promise better understanding.