Pay for depth, not for seats you are not using

Watch an autonomous investigation unfold live — Blackout resolves the identity, expands the network into a constellation, geolocates the infrastructure and scores the threat in real time, then hands you a briefing.

The live operational command centre — a cinematic global theatre fusing your watchlist threat board, DEFCON posture, recurring entities, live intelligence feed and worldwide operations into one screen.

Declare the standing questions that matter to you — geography, keywords and thresholds — and Blackout scores the live world against them continuously, surfacing answers without you going looking.

One-click OSINT — enter any target (domain, email, username, IP) and get a live compiled intelligence brief.

Visual entity-relationship graphs — connect people, orgs, domains, emails and more, then expand with transforms.

Your persistent knowledge base — every entity from every saved case, deduped and linked into one graph that compounds over time and surfaces shared people & infrastructure.

Investigate many targets at once — each fully assessed, threat-scored, ranked, and exported as one combined report.

Continuous monitoring — put any target under watch and get alerted the moment its exposure shifts: new ports, fresh CVEs, breaches, infrastructure moves.

Automated identity resolution — enter any selector and Blackout auto-pivots across every source, fuses linked identities into one scored subject dossier with a relationship graph, and exports it.

Autonomous investigation — give one target and Blackout resolves the identity, expands the whole connected network, correlates your cases and writes the assessment, hands-free.

Statistical anomaly detection across your watchlist — surfaces exposure-change surges and active-threat spikes against each target’s own baseline, so emerging escalations find you.

Pin persistent, live-updating notes to any entity — domain, IP, email, username or case — building shared analyst context that follows the entity across your workspace.

Turn a full technical workup into a board-ready narrative — bottom line, key judgements, risk rating and recommendations, in executive prose (AI-authored when an Anthropic key is connected).

Conversational OSINT — ask a question in plain English; Blackout runs live lookups on any domain/IP/email you mention, cross-references your cases, and answers grounded in real data.

Grade sources and information on the NATO Admiralty System — attach standardised reliability×credibility ratings to every finding and keep a source register, so confidence travels with your intelligence.

Named, repeatable investigation workflows — chain Blackout’s modules into one automated run (domain due diligence, entity screening, infrastructure threat assessment) with live step-by-step results.

SOC-grade phishing triage — paste a raw email and Blackout reconstructs the delivery path, verifies SPF/DKIM/DMARC, flags spoofing and extracts every indicator, locally.

Paste any blob — breach dumps, email headers, logs, chat exports — and Blackout extracts every email, IP, domain, URL, wallet, phone, CVE, hash and key locally, each one-click investigable.

Run investigations as cases — bundle saved reports and evidence, keep a timestamped notes timeline, and track status and priority from open to closed.

Automated recurring intelligence digests — watchlist changes, new high-threat findings and case activity compiled on a daily or weekly cadence and emailed to you as a branded PDF.

Command center — a live operational picture fusing your watchlist alerts, portfolio threat, recurring cross-case entities and global live events into one posture readout.

Geospatial plotting of entities, movements and areas of interest.

Reconstruct chronologies across every piece of collected evidence.

Chain-of-custody storage for artefacts, screenshots and exports.

Generate court-ready intelligence reports from any investigation.

Negative-news screening for KYC and due diligence — scan global news coverage of any person or company for fraud, corruption, litigation, sanctions and criminal reporting, categorised.

Global corporate intelligence with no key required — legal entity identity and ownership hierarchy (GLEIF), US SEC registrant and filing history, French national registry records with officers and filed financials, the Irish register with status and accounts filing history, and the Brazilian register by CNPJ with officers and share capital. Connect a free Companies House key for full UK officer, ownership and filing depth.

Pre-engagement due enquiry on a party you are about to advise on, contract with or litigate against — ownership, sanctions and adverse media, all three required, with every concern referred to a fee-earner rather than absorbed. Sealed, so the file can be checked by the other side.

Procurement due diligence in one pass — ownership, sanctions, adverse media and digital footprint, assessed against your policy. Tells you plainly when a required check could not be carried out, and what changed since last time.

KYC / AML due diligence — screen any person or entity against live sanctions and watchlists with fuzzy name matching, scored candidate matches and programme details.

Resolve identities from names, aliases and partial data across public records.

Attribute a target’s exposure profile to known threat actors — Blackout maps the attack surface to ATT&CK techniques, then ranks the APT and cybercrime groups whose playbooks overlap.

Map a target to the MITRE ATT&CK matrix — Blackout lights up the adversary techniques its real attack surface enables, and exports a Navigator layer for your SOC.

Given a set of entities, determine which of them are the same operation. Shared registrars, nameservers, netblocks, mail infrastructure, account-bound verification tokens and registration timing are weighted by how much each actually narrows the field — so commodity providers used by millions never link strangers.

External attack-surface management — discover every internet-facing asset an organisation exposes (subdomains, hosts, open ports, services, CVEs) and score it into a single exposure grade.

Assess any CVE with live NVD, EPSS and CISA KEV data — CVSS severity, real-world exploit probability, affected products, and whether it is actively exploited in the wild.

Audit a domain’s DNS and email-authentication hardening — SPF, DKIM, DMARC, MTA-STS, DNSSEC and CAA — graded A–F with every record and a fix for each gap.

Certificate Transparency reconnaissance — enumerate every subdomain and TLS certificate ever issued for a domain, spot freshly-minted and lookalike certs, and map the issuing CAs.

Drop any photo to expose GPS capture location, camera and lens, timestamps and authenticity signals — read in your browser. Opt into deep analysis for solar-position verification against the claimed time and place, perceptual fingerprints, C2PA and AI-generator detection, encoder fingerprinting and an exact-copy web search.

Composes advanced search-engine operators — exposed files, misconfigurations, login panels, credentials, social footprint — scoped to the search engine that actually covers the target’s region (Yandex, Baidu, Naver), explained and graded by sensitivity. Opens real, live results in a new tab; nothing is scraped or stored.

Carrier, line type, reputation and linked-account enrichment.

Deliverability, disposable/role detection and breach signals (deeper with a Hunter.io key).

WHOIS, full DNS, email security, hosting geolocation and certificate-transparency subdomains.

Cross-platform profile aggregation, network mapping and activity timelines.

Typosquat & phishing detection — generates look-alike domains for your brand and flags the ones already registered, before they are used against you.

Breach, leak & dark-web intelligence — detailed breach analytics and paste exposure for emails, and Tor-index (onion) search for any selector or keyword.

IOC reputation — aggregate live threat signals (Shodan risk tags & CVEs, Tor-exit membership, proxy/hosting, AbuseIPDB via BYOK) for any IP or domain into one verdict.

Wallet intelligence for Bitcoin & Ethereum — live balance, transaction activity and token exposure from any address.

Fund-flow tracing for BTC & ETH — map a wallet’s counterparties, inbound/outbound flows and flag known exchange & mixer (Tornado.Cash) interactions.

Map a target’s real-world infrastructure — resolve its web, mail and nameserver hosts, geolocate every IP, and plot the footprint across the live world map.

UK vehicle due diligence from the official DVLA register — make, colour, engine, tax and MOT standing, export and V5C history. Establishes what a vehicle is, never where it has been.

Push alerts to Slack, Discord or Microsoft Teams, and export any report as a STIX 2.1 bundle or CSV for your SIEM, TAXII server, MISP or OpenCTI.

Issue API keys and webhooks to query Blackout intelligence from your own systems.

Recent Sentinel and Landsat imagery for any point on earth — compare dates, switch to infrared or false colour, and see what changed on the ground. Free Copernicus data, rendered by the EO Browser.

Geolocated conflict and security reporting as it is published, pinned to the map and timestamped, across the active theatres.

Query OpenStreetMap directly for any feature type anywhere on earth — every petrol station in a city, every embassy in a country, every mast along a border. Results plot on the map and export as GeoJSON.

Sun position, azimuth and shadow length for any place on any date and time. The standard way to date an outdoor photograph from its shadows, or to test whether a claimed time and place are consistent with each other.

Real-time 3D global console — SIGINT feed, live world events and entity fusion graph.

Unified operative console — SITREP, live ledger, verification and case management.

GOV.UK-styled digital identity wallet and verifiable credential issuer.

AI governance & agent assurance terminal — policy builder, controls and audit trails.

ATLAS terminal, profile builder, deception engine and NEXUS entity graph.

Temporal intelligence & horizon-scanning workspace for tracking events over time.

Live multi-source operations feed — global events, seismic, weather and flight tracking.