Every good answer
starts with a question.

Built to take cyber defense out of its reactive stance. Instead of merely warning that a password has leaked, it catalogs the threat actors and the tactics, techniques and procedures they use, and with that knowledge carries out preventive defense.

• Diffuse. social networks, forums, deep and dark web: what the adversary thinks.
• Structured. permanent presence in the criminal's environment: what the adversary sees.
• Vulnerabilities. the attacker's way of operating crossed with the client's infrastructure and web applications.
• Proactive. a honeynet with hundreds of services that attract the attack and reveal the technique.

It listens to the social context, which sets it apart from social listening. What is public is collected as a matter of course, and the interest lies in closed groups, where plans are made and information is traded. Classification is done by its own AI, and the operation is run by people.

• Listening. mentions, profiles and groups on a topic or a territory, with audio and video transcription.
• Access. collection in closed environments through an intelligence operation, with no device intrusion and no broken encryption.
• Who speaks. profiles that repeat threats, coordinated accounts and the reach of each.
• Record. each finding with date, origin and screenshot, ready to support a formal complaint.

It cross-references financial, criminal and court records, open sources and the deep and dark web, starting from a name, CPF, CNPJ, phone number, license plate, e-mail or IP. The instance belongs to the client and receives the client's own databases in a one-way flow: IronFence data goes in, client data never comes back.

• Qualification. records, corporate ties, addresses and cases, with a graph of partners, relatives and successor companies.
• Follow-up. monitored lists, with an alert when a new company, a corporate change or a case appears.
• Exposure. what is accessible about an individual and their family, in open sources and in leaks.

Anonymized geolocation signals, with a history of up to three years. It does not follow a device in real time: the advantage lies in going back into the past. The analysis starts from a perimeter and returns who passed through, how often and at what hours.

• Routine of the place. who stays, who sleeps there and who frequents the perimeter.
• Hostile surveillance. the same device in front of an official's home and workplace, with no tie to either place.
• After the fact. the presence of devices at the site in the days before an incident.
• With Horus. in sensitive areas, the camera recognizes and Tracker shows the pattern of whoever is circling.

It recognizes faces and reads license plates on the cameras the client already has, compares them with the lists the client defines and alerts the security team on a match. The tool limits itself to the alert, and the approach is left to the team.

• Lists. positive, of who may enter a restricted area, and negative, of whom the client decided to flag.
• Three levels. observation, follow-up and restriction, with documentary grounds, validity period and review.
• Integration. operation across many cameras, compatible with existing video systems.

It reads phone extractions and gathers them in a data lake where contacts, transactions, locations and Wi-Fi networks are cross-referenced in a coordinated way. It runs on the client's infrastructure, with no limit on extractions, and the final filter is human.

• Graph. several devices linked by contact, Wi-Fi network, place or financial transfer, in a single drawing.
• Assistant. a chat with a language model over the extracted set, so the analyst can question the base.
• Local. runs on the client's infrastructure and does not charge per extraction.

From ChatGuard collection and open sources, it reports on planned or ongoing demonstrations: leaders, date, place, favorable or opposing stance, hostility and risk level. It is configured around the topics on the agenda and the groups that usually bring crowds to the institution.

• Anticipation. security knows days ahead what crowd will arrive, in what numbers and in what mood.
• Deployment. planning stops being a reaction at the door and is set up beforehand.
• Risk per event. assessment of a fair, match, public session or visit, on short notice.

The Financial Management System brings together PNCP, sanction registers, the Transparency Portal, the Federal Revenue's corporate records, Compras.gov prices, the Official Gazette, amendments and rulings of the Federal Audit Court. On this base of public sources, routines run by AI agents do what sample-based checking cannot.

• Price. research in the format of IN SEGES 65/2021, with open calculation memory, and signs of overpricing.
• Tender and collusion. tender steering index and alerts of collusion among bidders.
• Links. a graph up to four levels deep, with a risk report and an opinion drafted by the agent citing the legal provision.
• Private company. signs of criminal-faction involvement in a contract, company or shareholding, from link analysis.

It looks from the inside out, and so complements MAP. Firewall, SIEM, XDR, antivirus, honeypot and integrated CTI work as sensors, and a layer correlates everything and generates the incident. Sofia, an AI agent, detects the anomaly and builds the correlation, and Atlas validates before the queue opens. One contract replaces the seven or eight the same set usually requires.

• Workflow. the manager assigns the incident and sets the deadline, the operator handles it and returns it to the supervisor, and there is an audit profile.
• Network Monitor. inventory of servers, workstations and cloud, with AI-assisted observability.
• Penetration test. authorized intrusion attempt, run by the platform itself.
• Deployment. in the client's environment, in a sovereign cloud or in a hybrid model.

It takes in what arrives in an investigation, from the carrier record to the bank statement, and reads it all together. Each file enters with a SHA-256 fingerprint, and each decision has an author. The name is the method: analysis, network, intelligence, synthesis and evidence.

• Analysis and network. the fact becomes a question, and the graph shows who links to whom, by what path and what does not count as a link.
• AIRON. an assistant that searches by meaning and reads images inside the agency, with what it infers marked as inferred.
• Synthesis. a 360-degree profile of the target gathered in one place.
• Evidence. a hash-chained journal and a sealed report, verifiable by whoever receives it.

The Public Service Impressions Radar follows the city's social networks and press, separates what is a complaint about potholes, water, garbage or lighting and classifies it by theme, neighborhood and severity. Identical complaints in the same neighborhood within 24 hours become a single incident.

• Priority of the week. ranking of what weighs most for the public, with a trend of improvement or decline.
• Climate of the administration. reputation index of the city government on social networks and in the press.
• Press desk. tone of each story and who talks most about the city government.
• Deliverables. weekly executive report, CSV and PDF export and an API to connect to the 156 hotline center.

A form on the phone for people who work in the street: health agents, inspectors, surveyors, census takers. The manager publishes it on the portal, the agent fills it in offline, with photos, and the app sends everything when the signal returns. Before saving the position, it waits for the GPS to settle.

• Record. date, time and location of start and completion, with the measurement's precision.
• Forms. conditional sections, self-filling fields and validation before sending.
• Security. individual access, blocked microphone and each submission with time, position and device data.

An open-source platform for investigation and security agencies. Each case is an investigation with an owner, editors and readers. From a name, CPF, CNPJ, e-mail, phone number or profile, what is found becomes a graph, timeline, map and a report drafted with AI support.

• Enrichment. dozens of actions from a single identifier, in public, legal and registry sources and social networks.
• Monitoring. profiles, terms and groups followed around the clock, including forums and channels on the deep and dark web.
• RELINT. an intelligence report in PDF, with a trail of who consulted what and when.
• Governance. environment isolated per agency, login through the client's identity provider and use restricted to the investigative purpose.