Open-source intelligence firm
OSINT investigations that end in answers, not alerts.
Aldervane identifies the people, networks and money behind threats using lawfully obtained open-source information. Our investigators deliver attributed, evidenced findings with stated confidence, built to stand up in a boardroom, a courtroom or a cabinet briefing.
- 09:41:07REVIEWAttribution passed red-team reviewHIGH
- 09:38:52CHAINWallet clustered with 14 depositsMODERATE
- 09:36:15GEOStorefront photo geolocated to 40 mHIGH
- 09:33:40RESOLVEAlias tied to 3 registrant emailsHIGH
- 09:31:02INFRAAnalytics tag shared by 212 domainsHIGH
Trusted by teams who cannot afford to be wrong
- 40+Government and law enforcement agencies
- 7 of 20Largest global banks
- 60+Law firms and litigation teams
- 120+Corporate security programs
What we do
Eleven disciplines. One standard of proof.
Every engagement is led by a named senior investigator and staffed with specialists in the sources, languages and regions your question demands. Whatever the discipline, the deliverable is the same: a clear answer, the evidence behind it and an honest statement of confidence.
Investigations & Attribution
Unmask the operators behind fraud, extortion, leaks and harassment, and map the networks they rely on.
ExploreDue Diligence
See through nominee structures and reputational noise to the ownership, conduct and exposure that matter.
ExploreThreat Monitoring
Continuous, analyst-verified coverage of the threats aimed at your people, assets and brand.
ExploreProtective Intelligence
Assess threats against principals, identify who is behind them and shrink the exposure that makes them possible.
ExploreInfluence Operations
Detect coordinated inauthentic campaigns, measure their reach and attribute them to the people who run them.
ExploreDark Web Intelligence
Track leaked data, illicit markets and threat actor chatter, and connect anonymous personas to real activity.
ExploreScreening & Vetting
Confirm that hires, contractors and applicants for access are who they claim to be, with every discrepancy sourced.
ExploreInsider Risk
Find the warning signs that surface outside your network, and investigate them fairly under the direction of counsel.
ExploreSupply Chain Intelligence
Map the suppliers behind your suppliers and expose forced labor, sanctions and diversion risk, tier by tier.
ExploreGeopolitical Risk
Verified events and country risk measured against your people, sites and routes, in time to act.
ExploreOSINT Training
Hands-on tradecraft courses taught by the investigators who run our live cases.
ExploreNot sure where it fits?
Most questions cross disciplines. Describe the problem and we will design the engagement around it.
Start a conversationWhen clients call
It usually starts with a sentence like one of these.
Nobody calls an intelligence firm because they want a discipline. They call because something has happened, or is about to, and a decision is waiting on an answer.
"Someone says they have our data."
We test the claim from its samples, its seller and its history, without paying or engaging anyone.
See how Six hours of daylight"Do we move our people tonight?"
We verify each circulating claim, plot what is real against your routes and tell you which road is open.
See how Signing in three weeks"The ownership does not add up."
We trace the structure through its nominees and holding companies to the people who control it.
See how Back within days"We take the sites down and they return."
We find what the disposable sites share, and follow it to the one operator behind them.
See howResults, measured
We measure ourselves on outcomes.
Alerts are easy to count. We track what happened after we delivered: attributions confirmed, assets frozen, threats removed and transactions restructured. These are the numbers we hold ourselves to.
Case studies
Proof, not promises.
Client names are withheld and identifying details changed. The methods, timelines and outcomes are reported as they happened.
Retail banking
212 domains, one operator
A shared tracking tag tied a sprawling investment scam to a single operator, his payment rails and the shell companies holding the proceeds.
Consumer brands
From anonymous threats to a name in 36 hours
Escalating threats against a chief executive came from throwaway accounts. A reused image and a careless upload led to the person behind them.
Government
Mapping a 1,900-account network before a national vote
Creation-date clustering, recycled images and a shared posting schedule exposed a commercial influence operation posing as local voters.
Freight and logistics
The breach that was not
An extortion crew claimed 4 TB of stolen files and set a 72-hour deadline. Sample analysis showed recycled data from an old third-party breach, and the demand went unpaid.
Apparel and footwear
Four tiers down
Trade records, registry filings and local-language sources traced two facilities with forced labor indicators into the fourth tier of a brand's supply chain.
Energy
Six hours to decide
Viral footage showed unrest closing in on a remote site with 140 staff. Geolocation and native-language verification showed which claims were true and which road was open.
How we work
A disciplined process, from first question to final briefing.
Good open-source intelligence is not a search. It is a method. Ours has been refined across more than 2,600 investigations, and every case follows it.
-
01 / Define
Define the question
We turn your concern into precise intelligence requirements, agree what a decisive answer looks like and screen the request against our ethics policy.
-
02 / Collect
Collect lawfully
Analysts work across 1,100+ source categories through managed, non-attributable infrastructure, so subjects never learn they are being researched.
-
03 / Preserve
Preserve everything
Every page, post, image and record is captured with a timestamp and a SHA-256 hash at the moment of collection, creating a defensible chain of custody.
-
04 / Analyze
Resolve and analyze
Entities are resolved across sources, then tested with structured techniques that force competing explanations into the open before conclusions are drawn.
-
05 / Challenge
Challenge the finding
A senior analyst who did not work the case tries to break every attribution before it leaves the building. Findings that do not survive are not reported.
-
06 / Deliver
Deliver and debrief
You receive a finished report with sourced findings and stated confidence, followed by a debrief with the investigators who did the work.
The Aldervane platform
Tooling built by investigators, for investigators.
Our analysts work inside a proprietary platform designed around one idea: every conclusion should be traceable back to a preserved source in a few clicks.
- Aldervane ResolveEntity resolution and link analysis across identifiers, infrastructure, companies and wallets.
- Aldervane WatchContinuous collection with analyst-tuned detectors and human verification before anything is escalated.
- Aldervane CaptureForensic capture with hashing, timestamps and an audit trail for every item collected.
- Aldervane BriefFinished reporting with sourced findings, confidence levels and exportable evidence bundles.
- Aldervane ScreenIdentity integrity checks at volume, with every discrepancy reviewed by an analyst before it is reported.
- Aldervane AtlasVerified events, imagery and your sites and routes on one map, so relevance is measured in distance and not in keywords.
Who we serve
Built for the hardest questions in every sector.
The sources differ by sector. The standard does not. Choose a sector to see the work we do there.
Unclassified intelligence that complements what you already hold.
We support national security, defense and election integrity teams with attributable, shareable open-source findings that can be briefed widely without exposing sensitive collection.
- Foreign influence and interference campaigns
- Sanctions evasion and procurement networks
- Conflict monitoring and verification of imagery
- Election integrity assessments
- Who is operating this network of accounts, and for whom?
- Where was this video filmed, and when?
- Which front companies are moving controlled goods?
Leads that survive disclosure and cross-examination.
Prosecutors and investigators use our work to identify suspects, locate assets and corroborate evidence, with documentation designed to be disclosed.
- Suspect identification from online activity
- Asset tracing across registries and blockchains
- Victim identification in exploitation cases
- Evidence packages with full chain of custody
- Who controls the accounts advertising these victims?
- Where did the proceeds of this fraud go?
- Can this online persona be tied to our suspect?
Financial crime intelligence that names names.
Banks, payment firms and asset managers rely on us when screening tools return a match but not an answer, or when fraud has already happened and the question is who.
- Fraud network attribution and disruption
- Enhanced due diligence on high-risk customers
- Beneficial ownership behind nominee structures
- Sanctions exposure in counterparties and supply chains
- Who really owns this counterparty?
- Is this fraud ring connected to last quarter's losses?
- What does adverse media miss about this client?
Facts that hold up in litigation and arbitration.
We work under the direction of counsel to locate assets, identify witnesses, test the other side's narrative and preserve online evidence before it disappears.
- Asset tracing for judgment enforcement
- Pre-litigation intelligence and witness location
- Identification of anonymous defamers
- Preservation of web evidence to evidentiary standards
- Where are the judgment debtor's assets held?
- Who is behind this campaign against our client?
- What did this website say before it was edited?
Protect people, information and reputation.
Security, legal and risk teams use us to get ahead of threats to executives, identify the source of leaks and understand who they are really doing business with.
- Threats to executives and facilities
- Leak and insider investigations under counsel
- Counterfeit and brand abuse networks
- Third-party and partner integrity checks
- Is the person threatening our CEO capable of acting?
- Who posted our product roadmap?
- Who is selling counterfeit goods under our name?
Takedown packages that platforms can act on.
Trust and safety teams engage us to investigate coordinated abuse, attribute it to the people running it and assemble evidence that supports enforcement at scale.
- Coordinated inauthentic behavior investigations
- Scam and fraud network takedowns
- Off-platform activity that predicts on-platform harm
- Policy-ready reporting and evidence bundles
- Are these accounts one operation or many?
- Who sells the fake engagement behind this campaign?
- What are banned actors planning off-platform?
Client perspectives
What clients say when the work is done.
Three vendors had given us spreadsheets of indicators. Aldervane gave us a name, the evidence behind it and a report our regulator accepted without a single follow-up question.
They told us on day one what open sources could and could not prove. Then they proved more than we expected, and every claim in the report traced back to a preserved source.
When the threats against our chief executive escalated on a Friday night, Aldervane had a name by Sunday morning and a referral package ready for police on Monday.
Why Aldervane
Most providers sell data. We deliver conclusions.
Data platforms and alert services have their place. When the question is who, how and what to do about it, the difference is in what you receive at the end.
| What you receive | Data platforms | Alert services | Aldervane |
|---|---|---|---|
| Named, attributed subjects | Rarely | Rarely | Yes, with stated confidence |
| Evidence captured and hashed at collection | Varies | No | Every item |
| Independent second-analyst review | No | No | Every attribution |
| Native-language analysis | Machine translation | Limited | 41 working languages |
| Fixed fee and committed timeline | Not applicable | Not applicable | Yes |
| Reporting built for courts and regulators | No | No | Yes |
Standards
Lawful. Proportionate. Defensible.
The value of intelligence depends on how it was obtained. Our standards are written down, enforced on every case and published so that clients, courts and counterparties know exactly what we will and will not do.
- Lawful collection onlyPublicly available and lawfully obtained information. No intrusion, no pretexting and no purchased stolen data.
- We say noEvery request is screened for purpose and proportionality. We decline roughly one in seven.
- Evidence integrityHashed at capture, logged and reproducible by an independent examiner.
- Data minimizationCase data is deleted 90 days after closure unless a legal hold requires otherwise.
Research
Tradecraft, published.
Field notes and guides from our investigators. We publish how we work because methods that cannot be explained should not be trusted.
Outlook 2027: six shifts in the open-source threat picture
Synthetic identities, rented infrastructure and faster rumor cycles are changing what open sources can prove. What we expect next year, and how we are preparing.
Read the outlookOne tag, 212 domains: a field note on infrastructure pivoting
How a reused analytics identifier, certificate history and registrant patterns turned a list of scam sites into a map of one operation.
Read the field noteAttribution is a standard of proof: how we grade confidence
Why we separate source reliability from information credibility, and how a finding earns the word "high" in our reports.
Read the articleStart an engagement
Bring us the question nobody else could answer.
Tell us what you need to know and why. A senior investigator will scope it with you, tell you candidly what open sources can and cannot establish, and propose a plan with a fixed fee and a firm timeline.