101 modules, 221 graded collectors.

Watch an autonomous investigation unfold live — Blackout resolves the identity, expands the network into a constellation, geolocates the infrastructure and scores the threat in real time, then hands you a briefing.

The live operational command centre — a cinematic global theatre fusing your watchlist threat board, DEFCON posture, recurring entities, live intelligence feed and worldwide operations into one screen.

Declare the standing questions that matter to you — geography, keywords and thresholds — and Blackout scores the live world against them continuously, surfacing answers without you going looking.

Import and inspect STIX 2.x intelligence, preserve relationships, markings and confidence, pivot observables into Blackout collection and file external intelligence into a case.

Record when an entity was actually observed — first seen, last seen, source, confidence and notes — so repeated observations become a defensible time series rather than duplicate case notes.

Search cases, reports, evidence, sightings, graph entities and operational history as one organisation-scoped intelligence corpus — without remembering which module first found the subject.

Analyst quality-control for structured findings — review source grade and evidence, accept or reject conclusions, return weak items for more work, and preserve the review decision in the intelligence record.

Build, save and run repeatable investigation workflows by chaining Blackout collectors in a controlled sequence — with per-step outputs, failures and case filing preserved.

Apply TLP-style handling, internal sensitivity and organisation taxonomy tags to intelligence so sharing rules and analytic context travel with the item rather than living in someone’s memory.

Secure read-only connections to MISP, OpenCTI and TAXII 2.1 — encrypted credentials, connection health, auditable pulls and direct pivots from external intelligence into Blackout.

The record under the live picture: event, publication and collection time kept apart, every correction and retraction preserved, and the difference between a new story, a changed one and the same one arriving again — plus the regions, languages and topics nobody here covers.

A plain-language requirement becomes a collection plan you read before it runs — lanes, budgets, the authority it is run under, what would make it stop, and the two searches it would otherwise have duplicated or missed.

A report that carries its own analysis: every step from retained snapshot to finding, labelled by whether it can be replayed exactly, re-run with a different answer, or only recorded — because replaying a calculation proves nothing about a judgement.

Collection ordered by how soon the evidence stops being available — a published deadline, an estimated window, or unknown, kept apart, because an unknown that renders as a number is a guess wearing a measurement.

Which conclusions survive a plausible correction — remove a source family, collapse syndicated copy, fix a timezone, take the second-best entity match. Reports stability under the tests that were run, never a probability that a finding is true.

The collection control plane — what each connector is contracted to cover, which workflows lose capability when it fails, its circuit state and backoff, and any provider schema change, proposed as an inert repair that waits for a human.

Cross-case correlation that finds exact shared domains, emails, IPs, hashes, wallets and other structured selectors across investigations — surfacing hidden overlaps as leads without pretending that correlation proves common ownership or cause.

Analysis of Competing Hypotheses for any investigation — state alternative explanations, test each observation against all of them, surface contradictions and gaps, and preserve the analytic matrix with the case instead of hiding the reasoning behind a conclusion.

Competing explanations for a developing situation, with what each one predicts you would see — and a check that the source which would hold that evidence actually covered the period, place and topic before its silence is allowed to count against anything.

Your persistent knowledge base — every entity from every saved case, deduped and linked into one graph that compounds over time and surfaces shared people & infrastructure.

Investigate many targets at once — each fully assessed, threat-scored, ranked, and exported as one combined report.

Autonomous investigation — give one target and Blackout resolves the identity, expands the whole connected network, correlates your cases and writes the assessment, hands-free.

Statistical anomaly detection across your watchlist — surfaces exposure-change surges and active-threat spikes against each target’s own baseline, so emerging escalations find you.

Turn a full technical workup into a board-ready narrative — bottom line, key judgements, risk rating and recommendations, in executive prose (AI-authored when an Anthropic key is connected).

Conversational OSINT — ask a question in plain English; Blackout runs live lookups on any domain/IP/email you mention, cross-references your cases, and answers grounded in real data.

Named, repeatable investigation workflows — chain Blackout’s modules into one automated run (domain due diligence, entity screening, infrastructure threat assessment) with live step-by-step results.

Run investigations as cases — bundle saved reports and evidence, keep a timestamped notes timeline, and track status and priority from open to closed.

Automated recurring intelligence digests — watchlist changes, new high-threat findings and case activity compiled on a daily or weekly cadence and emailed to you as a branded PDF.

Command center — a live operational picture fusing your watchlist alerts, portfolio threat, recurring cross-case entities and global live events into one posture readout.

Chain-of-custody storage for artefacts, screenshots and exports.

Generate court-ready intelligence reports from any investigation.

Negative-news screening for KYC and due diligence — scan global news coverage of any person or company for fraud, corruption, litigation, sanctions and criminal reporting, categorised.

Global corporate intelligence with no key required — legal entity identity and ownership hierarchy (GLEIF), US SEC registrant and filing history, French national registry records with officers and filed financials, the Irish register with status and accounts filing history, and the Brazilian register by CNPJ with officers and share capital. Connect a free Companies House key for full UK officer, ownership and filing depth.

Pre-engagement due enquiry on a party you are about to advise on, contract with or litigate against — ownership, sanctions and adverse media, all three required, with every concern referred to a fee-earner rather than absorbed. Sealed, so the file can be checked by the other side.

Procurement due diligence in one pass — ownership, sanctions, adverse media and digital footprint, assessed against your policy. Tells you plainly when a required check could not be carried out, and what changed since last time.

KYC / AML due diligence — screen any person or entity against live sanctions and watchlists with fuzzy name matching, scored candidate matches and programme details.

Everything on one company, in one document. Statutory registers, officers and beneficial ownership, sanctions screening on the registered legal name, adverse media, the registered office looked up from the filing itself, and the open-web record — with a single collection record covering the whole search.

Attribute a target’s exposure profile to known threat actors — Blackout maps the attack surface to ATT&CK techniques, then ranks the APT and cybercrime groups whose playbooks overlap.

Map a target to the MITRE ATT&CK matrix — Blackout lights up the adversary techniques its real attack surface enables, and exports a Navigator layer for your SOC.

Given a set of entities, determine which of them are the same operation. Shared registrars, nameservers, netblocks, mail infrastructure, account-bound verification tokens and registration timing are weighted by how much each actually narrows the field — so commodity providers used by millions never link strangers.

External attack-surface management — discover every internet-facing asset an organisation exposes (subdomains, hosts, open ports, services, CVEs) and score it into a single exposure grade.

Assess any CVE with live NVD, EPSS and CISA KEV data — CVSS severity, real-world exploit probability, affected products, and whether it is actively exploited in the wild.

Audit a domain’s DNS and email-authentication hardening — SPF, DKIM, DMARC, MTA-STS, DNSSEC and CAA — graded A–F with every record and a fix for each gap.

Certificate Transparency reconnaissance — enumerate every subdomain and TLS certificate ever issued for a domain, spot freshly-minted and lookalike certs, and map the issuing CAs.

One search across six indexes at once. Results kept apart by how many independent indexes agree, and the pages an archive holds that no live index returns any more shown first. Brave, Google and Yandex light up with your own keys; the rest need none.

Typosquat & phishing detection — generates look-alike domains for your brand and flags the ones already registered, before they are used against you.

Breach, leak & dark-web intelligence — detailed breach analytics and paste exposure for emails, and Tor-index (onion) search for any selector or keyword.

IOC reputation — aggregate live threat signals (Shodan risk tags & CVEs, Tor-exit membership, proxy/hosting, AbuseIPDB via BYOK) for any IP or domain into one verdict.

Fund-flow tracing for BTC & ETH — map a wallet’s counterparties, inbound/outbound flows and flag known exchange & mixer (Tornado.Cash) interactions.

Map a target’s real-world infrastructure — resolve its web, mail and nameserver hosts, geolocate every IP, and plot the footprint across the live world map.

UK vehicle due diligence from the official DVLA register — make, colour, engine, tax and MOT standing, export and V5C history. Establishes what a vehicle is, never where it has been.

Bring files and digital artefacts into Blackout with a local integrity fingerprint, static triage, printable-indicator extraction and immediate pivots into the wider investigation.

Hash and extract PDF or text-based evidence locally, identify selectors inside documents, pivot them directly into Blackout and file the document-derived intelligence into a case.

Normalize CSV, JSON, NDJSON and timestamped log exports into a searchable chronology with selector extraction, case filing and optional insertion into Blackout’s shared operational timeline.

Push alerts to Slack, Discord or Microsoft Teams, and export any report as a STIX 2.1 bundle or CSV for your SIEM, TAXII server, MISP or OpenCTI.

Where this workspace’s intelligence is currently wrong, across every investigation: two cases giving different answers about one subject, a source that carries weight and has stopped answering, and filings citing values the record has moved past. Ordered by whether somebody can be acting on it wrongly right now.

Every collector this platform reaches, grouped by discipline and separated by what is wrong with it: usable now, rate limited, awaiting a key you could add, failing, or never proven. With the Admiralty grade, the round trip, and which modules lose depth without it.

Issue API keys and webhooks to query Blackout intelligence from your own systems.

Query OpenStreetMap directly for any feature type anywhere on earth — every petrol station in a city, every embassy in a country, every mast along a border. Results plot on the map and export as GeoJSON.

Sun position, azimuth and shadow length for any place on any date and time. The standard way to date an outdoor photograph from its shadows, or to test whether a claimed time and place are consistent with each other.

Unified operative console — SITREP, live ledger, verification and case management.

The original governance terminal: policy builder, controls and a view over this platform’s own activity log. Superseded for agent decision recording by AgentAudit.

ATLAS terminal, profile builder, deception engine and NEXUS entity graph.

Temporal intelligence & horizon-scanning workspace for tracking events over time.

Live multi-source operations feed — global events, seismic, weather and flight tracking.