Use cases
The situations that bring clients to us.
Nobody calls an intelligence firm because they want a discipline. They call because something has happened, or is about to, and a decision is waiting on an answer. These are the sixteen situations we are asked about most often, in the words clients use when they first describe them.
The clock is running
For the hours when the answer cannot wait.
Some questions arrive with a deadline somebody else has set. Urgent tasking is accepted around the clock, and the first assessment is measured in hours.
"Someone says they have our data, and a countdown has started."
An extortion post is a claim, not a notification. We test it from its samples, its seller and its history, without paying or engaging anyone.
- Listing, file tree and samples preserved and hashed
- Samples dated, traced to their origin and matched against earlier leaks
- A graded conclusion: fabricated, recycled, third party or genuine
"The threats against our chief executive are getting more specific."
Most hostile messages are noise. A few come from someone with intent and the means to act. We tell you which kind this is, and who is behind it when the evidence allows.
- Structured threat assessment by a protective intelligence lead
- Identification of the author from open sources where possible
- A referral package for police and a plan to reduce exposure
"There is unrest near our site and I have to decide whether to move people."
The first footage is fast and often false. Our regional desks verify each claim, plot what is real against your routes and say what is likely to happen next.
- Every circulating claim logged and tested separately
- Verified events measured against your sites and routes
- A decision brief with options and their trade-offs
"Our confidential plans are on a forum, and only our own people had them."
A leak needs a fair answer quickly. Working under counsel, we establish what the leaked item itself reveals about where and when it was produced.
- Leaked material preserved before it is edited or removed
- Document and screenshot artifacts analyzed
- Findings to counsel, with innocent explanations tested first
Before you commit
Decisions with a date attached.
A signing, a hire, a shipment, a market entry. The date is fixed and the question is whether there is anything you would want to know before it arrives.
"We sign in three weeks and the ownership does not add up."
Nominee directors and layered holding companies exist to stop this question being answered. We trace the structure to the people who control it.
- Ownership chart to the ultimate beneficial owner
- Red flags ranked by severity, each with its evidence
- Material findings reported as they are confirmed
"We are about to give administrator access to someone we have never met."
Document checks confirm that an identity is real. We test whether the history presented with it could only belong to the person presenting it.
- Footprint, portfolio and employer claims tested
- Discrepancies ranked and reviewed by an analyst
- The subject informed, and able to respond
"Customs wants evidence of what sits beneath our suppliers."
Questionnaires stop at tier one. Shipment records, registries and local-language sources do not. We rebuild the tiers and grade every link.
- Tiered supplier map from your tier-one list alone
- Each link graded as confirmed, probable or possible
- An evidence annex ready to show an authority
"We are entering a new market next year. What should we know first?"
Country risk and counterparty risk are the same question asked at different scales. We answer both, for the specific project and the specific partners.
- Political, security and operational assessment
- Due diligence on partners, officials and intermediaries
- Indicators to watch once you are committed
It keeps happening
Problems that return until someone finds the cause.
Takedowns, declinations and blocks treat each incident as separate. When incidents share an operator, the only lasting fix is to find that operator.
"We take the scam sites down and they are back within days."
Disposable websites share infrastructure, payment accounts and habits. One reused identifier can turn two hundred problems into one.
- Infrastructure pivots to map the whole operation
- Payment and blockchain tracing to the cash-out points
- A referral package law enforcement can act on
"A wave of accounts is attacking us and we cannot tell if it is real."
Genuine anger and manufactured anger look alike from inside the storm. We assess behavior, not opinions, and say whether the accounts are coordinated.
- Network map with the evidence for every link
- Attribution to operators where the evidence supports it
- Takedown packages mapped to platform policies
"These claims look connected, but a resemblance is not proof."
Analytics find patterns. Declining a claim takes evidence. We establish which claims share organizers, and which are honest claims that merely look similar.
- A proportionate scope agreed in writing
- Independent lines of evidence for each link
- Genuine claims identified early so they can be paid
"Someone is selling counterfeits under our name in a dozen countries."
Storefronts are the visible end of a supply chain. We follow it back through sellers, payment accounts, shippers and factories to the people organizing it.
- Seller accounts resolved to a smaller number of operators
- Logistics and corporate records traced to source
- Evidence for civil action, customs and platforms
Standing needs
Capability you want in place before the call comes.
Not every need is an incident. Some are the reason the next incident is caught early, or handled by your own team.
"We need someone watching for threats to our people around the clock."
A watch floor staffed across 14 time zones, with detectors built from your requirements and every alert read by an analyst before it reaches you.
- Critical threats escalated within 60 minutes
- Weekly digest and monthly review with a named analyst
- Fewer alerts, each one verified
"A senior colleague may have a second employer we were never told about."
Patents, grants, conference programs and company filings are public. Read together and fairly, they show whether a declared role is the whole story.
- Scope limited to public professional records
- Identity established before anything else
- What open sources cannot answer, handed back unanswered
"We mapped our suppliers last year. We have no idea if it is still true."
Suppliers change their own suppliers every season. Retained clients have their maps refreshed and are told when a mapped entity is newly listed or reported.
- Shipment data refreshed every quarter
- Mapped entities re-screened as lists change
- New intermediaries on old routes flagged
"Our own team should be able to do more of this."
Tradecraft courses taught by the investigators who run our live cases, with exercises built from real work and a method students keep.
- Four core courses and custom programs
- Maximum 16 students per class
- Thirty days of instructor support afterward
Whatever the situation
Sixteen situations. One way of working.
The urgency changes and the sources change. The method does not, and neither does what you can expect from us.
- The question agreed firstA senior investigator turns the situation into written requirements before any collection begins.
- Screened for purposeEvery request is checked for legitimacy and proportionality. We decline roughly one in seven.
- Evidence preservedEvery item relied on is captured, timestamped and SHA-256 hashed at the moment of collection.
- Independently challengedAn analyst who did not work the matter tries to break the conclusion before it reaches you.
- Confidence statedEach judgment carries a probability term and a confidence level, with the limits said plainly.
- A fixed feeAgreed at scoping, with a committed timeline. The fee never depends on what we find.
Start an engagement
Bring us the question nobody else could answer.
Tell us what you need to know and why. A senior investigator will scope it with you, tell you candidly what open sources can and cannot establish, and propose a plan with a fixed fee and a firm timeline.