The challenge
Security analysts worked across dozens of disconnected sources: OSINT feeds, commercial threat-intelligence providers, corporate registries, sanctions lists, domain and infrastructure data. Each had its own format and identifiers, so linking a person, company, domain or threat actor across sources was slow and manual, and AI assistants could not reason over the data as a whole.
Our approach
- Designed a domain ontology for the security and cyber-intelligence world, covering entities such as people, organisations, assets, infrastructure, threat actors, events and the relationships between them.
- Mapped OSINT and third-party data sources to the ontology and built ingestion pipelines with provenance and confidence recorded for every fact.
- Applied entity resolution to link the same real-world entity across sources into a single knowledge graph.
- Exposed the graph through a unified semantic layer that AI agents can query in natural language, combining graph traversal with retrieval to return fused, source-cited answers.