Cyber threat intelligence answer engine
AI-enabled intelligence management platform built on prioritised intelligence requirements. Automated collection, analysis, and dissemination, and source-checked reporting, so you always have the answers that matter.
Headlines sourced from third parties. Click any item to read the original article on the publisher's site.
Automated, Open-Source Cyber Threat Intelligence Cross-Referenced against
MITRE ATT&CK® is a registered trademark of The MITRE Corporation.
Conundrum is not another feed to read. You set the questions that matter to your organisation, and everything the platform collects, scores, writes and routes is answerable to one of them.
Written down and standing, at organisation, sector and global tiers, tuned to your industry when you are onboarded and edited by your team as the questions change.
Finished intelligence in a fixed shape — executive summary, situation, assessment, recommendations — each naming the requirement it answers and checked against its own sources before anyone reads it.
Triage what came in, question it, edit and annotate the draft, publish it with version history, and route it to the people and systems that need it on the rules your admins set.
Direction through feedback, with the evidence attached at every step.
You decide what the platform cares about. Requirements come first, and collection, scoring and reporting follow from them.
Learn more →Intelligence arrives without anyone fetching it, and you can see when it stops arriving, which matters more than the volume that does.
Learn more →Your analysts work the intelligence: triaging it, questioning it and mapping it against the frameworks they already use.
Learn more →Your team writes intelligence rather than only reading it, and what the platform generates is checked before it reaches anyone.
Learn more →Finished intelligence reaches the people who need it, and the systems they work in, on the routing rules you set.
Learn more →What your team does with the intelligence comes back into it, visibly, with the evidence attached.
Learn more →PIRs at organisation, sector and global tiers, tuned to your industry.
Open-source collection across the five major attack vectors, plus geopolitics.
Reports scored against their own sources before publication.
Ask questions of your own intelligence and get cited answers, or a refusal.
CISA SSVC decisions with KEV and EPSS, personalised by your requirements.
Ransomware leak-site listings tracked and matched against your watchlists.
Edit, annotate and publish, with version history on every published report.
Signed outbound webhooks and a read-only agent interface over your intelligence.
Eight capabilities of many — more features within each stage above, and still growing.
Every report the platform generates answers a requirement you set, and is checked before anyone reads it.
There's a gap in every kind of threat reporting between what gets published and what's actually worth acting on. Vulnerabilities make the clearest example, because the numbers are public: most disclosed each year are never exploited. It's why we start from a requirement, not a feed.
Disclosed in 2025, spanning thousands of vendors and products.
Added to CISA's Known Exploited Vulnerabilities catalogue in the same period.
How those two numbers compare, over the same period.
Every vulnerability CISA has confirmed as exploited since the catalogue began.
Counted from the National Vulnerability Database and the CISA Known Exploited Vulnerabilities catalogue for calendar year 2025, read from both sources on 18 September 2026. Figures you can re-run yourself.
The judgements that carry consequences stay with your analysts. This is a design position rather than a roadmap gap, and it is the part of the product we are least likely to change.
Nothing reaches a recipient on a machine's initiative. Routing follows rules your admins set, and a person decides who is told what.
Naming the actor behind an intrusion is an analytic judgement with consequences. It is made by an analyst who can defend it, never inferred on your behalf.
We do not show a number a model produced about its own certainty. Where sourcing strength matters, it is described in the terms analysts already use.
Asked something your intelligence cannot answer, the assistant says so. On the benchmark we hold it to, nothing was invented to fill the gap.
Software alone doesn't make an intelligence capability. The methodology comes first; the platform operationalises it.
The requirement comes first. Everything the platform collects, scores and reports is answerable to a question somebody actually asked.
Tools change. The intelligence cycle does not, and a team that runs it well outperforms a team with better software and no discipline.
Priority intelligence requirements, collection planning, intelligence gaps, the intelligence cycle, explained properly by the author of the methodology and cross-linked so it reads as a reference rather than a blog.
A demo runs on your sector's intelligence, not a canned dataset.
