Industries
Built for the hardest questions in every sector.
The sources differ by sector, and so do the decisions our findings support. The standard does not: lawful collection, preserved evidence, independent review and a stated level of confidence behind every conclusion.
Trusted by teams who cannot afford to be wrong
- 40+Government and law enforcement agencies
- 7 of 20Largest global banks
- 60+Law firms and litigation teams
- 120+Corporate security programs
Government & Defense
Unclassified intelligence that complements what you already hold.
National security, defense and election integrity teams use us for open-source findings that can be shared widely, briefed publicly when needed and attributed without exposing sensitive collection.
Our analysts work in 41 languages and are used to the discipline of government reporting: clear key judgments, explicit confidence and sourcing that can be released to the audiences you choose.
- Foreign influence and interference campaigns
- Sanctions evasion and illicit procurement networks
- Conflict monitoring and verification of imagery and video
- Election integrity assessments and rapid response
- Front companies and shipping behind controlled goods
Related services
- Who is operating this network of accounts, and for whom?
- Where and when was this video filmed?
- Which front companies are moving controlled goods?
Government
Mapping a 1,900-account network before a national vote
Creation-date clustering, recycled images and a shared posting schedule exposed a commercial influence operation posing as local voters.
Law Enforcement & Prosecutors
Leads that survive disclosure and cross-examination.
Investigators and prosecutors use our work to identify suspects, trace assets and corroborate evidence, with documentation designed from the start to be disclosed.
We support agencies directly and through the banks, companies and NGOs that refer cases to them. Every item we collect is hashed at capture, our methods are documented and reproducible, and our investigators can provide witness statements.
- Suspect identification from online activity
- Asset tracing across registries and public blockchains
- Victim identification in exploitation and trafficking cases
- Evidence packages with a full chain of custody
- Tradecraft training for investigators and analysts
Related services
- Who controls the accounts advertising these victims?
- Where did the proceeds of this fraud go?
- Can this online persona be tied to our suspect?
Retail banking
212 domains, one operator
A shared tracking tag tied a sprawling investment scam to a single operator, his payment rails and the shell companies holding the proceeds.
Financial Services
Financial crime intelligence that names names.
Banks, payment firms and asset managers rely on us when screening returns a match but not an answer, or when fraud has already happened and the question is who.
Our work is built to support suspicious activity reporting, regulator inquiries, transaction decisions and law enforcement referrals. Seven of the 20 largest global banks are clients.
- Fraud network attribution and disruption
- Enhanced due diligence on high-risk customers and counterparties
- Beneficial ownership behind nominee structures
- Sanctions exposure in counterparties, fleets and supply chains
- Mule account and cash-out network investigations
Related services
- Who really owns this counterparty?
- Is this fraud ring connected to last quarter's losses?
- What does adverse media miss about this client?
Private equity
The shareholder who was not there
Eleven shell entities across four jurisdictions hid a beneficial owner linked to a sanctioned individual, three weeks before signing.
Legal & Litigation
Facts that hold up in litigation and arbitration.
We work under the direction of counsel to locate assets, identify witnesses and anonymous actors, test the other side's narrative and preserve online evidence before it disappears.
Engagements are structured to protect privilege. Our reports are written for courts and tribunals, and our investigators are experienced at explaining their methods to judges, arbitrators and opposing experts.
- Asset tracing for judgment and award enforcement
- Pre-litigation intelligence and witness location
- Identification of anonymous defamers and harassers
- Preservation of web evidence to evidentiary standards
- Background research on opposing parties and experts
Related services
- Where are the judgment debtor's assets held?
- Who is behind this campaign against our client?
- What did this website say before it was edited?
Technology manufacturing
Attributing a product roadmap leak in nine days
A confidential roadmap surfaced on an enthusiast forum. Screenshot artifacts, posting habits and the client's own access records narrowed 340 possible sources to one.
Corporate Security
Protect people, information and reputation.
Security, legal and risk teams use us to get ahead of threats to executives and facilities, find the source of leaks and understand who they are really doing business with.
We work as an extension of your security team, on retainer for monitoring and rapid response or engaged case by case when something goes wrong. Critical threats reach you within 60 minutes, day or night.
- Threats to executives, staff and facilities
- Leak and insider investigations under counsel
- Counterfeit and brand abuse networks
- Third-party and partner integrity checks
- Travel and event security intelligence
Related services
- Is the person threatening our chief executive capable of acting?
- Who posted our product roadmap?
- Who is selling counterfeit goods under our name?
Consumer brands
From anonymous threats to a name in 36 hours
Escalating threats against a chief executive came from throwaway accounts. A reused image and a careless upload led to the person behind them.
Platforms & Trust and Safety
Takedown packages that platforms can act on.
Trust and safety teams engage us to investigate coordinated abuse, attribute it to the people running it and assemble evidence that supports enforcement at scale.
We understand enforcement workflows. Our referrals map the evidence for every account to the specific policy it violates, so your teams can act without redoing the analysis.
- Coordinated inauthentic behavior investigations
- Scam and fraud network takedowns
- Off-platform activity that predicts on-platform harm
- Commercial services selling fake engagement
- Policy-ready reporting and evidence bundles
Related services
- Are these accounts one operation or many?
- Who sells the fake engagement behind this campaign?
- What are banned actors planning off-platform?
Seven signals that separate a network from a crowd
Organic outrage and coordinated campaigns can look identical at a glance. These are the signals that tell them apart.
Read the analysisInsurance
Separate organized fraud from honest claims.
Insurers and claims investigators use us to uncover organized fraud rings, review suspicious claims proportionately and support recovery and litigation.
We apply the same standards to claims work as to every other investigation: lawful public sources only, a proportionate scope agreed in advance and findings that say plainly when the evidence supports the claimant.
- Organized fraud ring detection across multiple claims
- Staged incident and collusion networks
- Proportionate review of public information relevant to a claim
- Asset tracing for subrogation and recovery
- Due diligence on intermediaries, repairers and suppliers
Related services
- Are these claims connected to the same people?
- Who sits behind this network of repair shops and witnesses?
- Does the public record support or contradict this claim?
What proportionate means
We agree the scope in writing before work starts and limit research to what is relevant to the claim. We never monitor private accounts, never use deception and never contact claimants. Where the evidence supports a claim, our report says so.
Read our standardsMotor insurance
One crash, eleven claims
The same tow truck, two repair shops and a handful of phone numbers connected 46 collision claims to nine organizers. Seven flagged claims proved genuine and were paid.
NGOs & Humanitarian
Investigations for organizations that protect people.
Human rights organizations, humanitarian agencies and anti-trafficking groups use us to document abuses, expose exploitation networks and keep staff safe in high-risk environments.
Two percent of our analyst hours each year go to pro bono investigations, and we offer reduced rates and tradecraft training to nonprofit organizations.
- Trafficking and exploitation network investigations
- Documentation and verification of human rights abuses
- Security assessments for staff in high-risk locations
- Integrity checks on partners and suppliers
- Training for researchers and caseworkers
Related services
- Are these cases connected to one network?
- Can this footage be verified and dated?
- Is it safe for our staff to work in this region?
NGO coalition, pro bono
Fake job ads, real victims
Recruitment ads in four languages shared contact details, photos and fee structures that exposed one labor trafficking recruitment network.
Technology & Research
Protect the ideas, the code and the people who produce them.
Technology companies, research institutions and life sciences firms use us to confirm who they are hiring and partnering with, and to investigate when work, access or people turn up somewhere they should not.
Our scope is set by conduct and by role, never by a person's background. Checks are disclosed to the people concerned, and matters involving staff are run under the direction of counsel.
- Identity integrity checks for remote and privileged hires
- Undisclosed affiliations, outside appointments and conflicting patents
- Access, source code and data offered for sale
- Due diligence on research partners, investors and acquirers
- Leak investigations and counterfeit or cloned products
Related services
- Is this remote engineer the person on the resume?
- Does our collaborator have a second employer?
- Who is selling access to our build systems?
Enterprise software
Nineteen engineers who were not there
Recycled portfolios, mismatched histories and shared payout details tied nineteen remote contractors to four facilitators operating borrowed identities.
Energy & Critical Infrastructure
Know what is happening around the sites you cannot move.
Energy, mining and infrastructure operators use us for verified intelligence on unrest, conflict and policy change near fixed assets, and for integrity work on the partners and officials those assets depend on.
Six regional desks verify events against each client's own sites and routes. Critical developments near a named location reach the client within 60 minutes, and crisis tasking produces a first verified report within 2 hours.
- Verified event intelligence for sites, routes and staff housing
- Country, market-entry and project risk assessments
- Integrity due diligence on joint venture partners and agents
- Threats, activism and protest activity directed at facilities
- Evacuation and continuity support during a crisis
Related services
- Is the road to our site actually blocked?
- Who really stands behind this local partner?
- What would have to happen for us to pull people out?
Energy
Six hours to decide
Viral footage showed unrest closing in on a remote site with 140 staff. Geolocation and native-language verification showed which claims were true and which road was open.
Manufacturing & Consumer Goods
See the suppliers behind your suppliers.
Brands and manufacturers use us to map the lower tiers of their supply chains, test them for forced labor, sanctions and diversion exposure, and trace counterfeit goods back to the people producing them.
We work from a tier-one supplier list and public records alone. Suppliers are never contacted, every link is graded and every record is preserved in a form a regulator or customs authority can examine.
- Sub-tier supplier mapping by product line
- Forced labor indicators at facilities in the lower tiers
- Sanctions exposure through ownership and control
- Diversion of controlled goods through distributors
- Counterfeit production and gray market channels
Related services
- What sits beneath our tier-one suppliers?
- Do three of our suppliers share one source?
- Where are the counterfeits being made?
Apparel and footwear
Four tiers down
Trade records, registry filings and local-language sources traced two facilities with forced labor indicators into the fourth tier of a brand's supply chain.
Transport & Logistics
Keep goods, data and reputation moving.
Freight forwarders, carriers and logistics platforms sit between thousands of customers and hold data about all of them, which makes them a frequent target for extortion, cargo fraud and misuse by people moving restricted goods.
We verify extortion and breach claims around the clock, investigate the networks behind cargo and identity fraud, and identify customers and routes that expose a carrier to sanctions and diversion risk.
- Verification of leak, breach and extortion claims
- Fictitious carrier and cargo theft networks
- Customers and consignees linked to sanctioned parties
- Transshipment routes used to divert controlled goods
- Verified event intelligence for ports, corridors and crews
Related services
- Is this claimed breach of our systems real?
- Is this new carrier who it says it is?
- Why has this consignment been routed through a third country?
Freight and logistics
The breach that was not
An extortion crew claimed 4 TB of stolen files and set a 72-hour deadline. Sample analysis showed recycled data from an old third-party breach, and the demand went unpaid.
Start an engagement
Bring us the question nobody else could answer.
Tell us what you need to know and why. A senior investigator will scope it with you, tell you candidly what open sources can and cannot establish, and propose a plan with a fixed fee and a firm timeline.