The intelligence market stops after two stages. First, observation: the platform collects artefacts and hands over a list of indicators. Second, understanding: context is added to the indicator and a report is written. The third stage, acting, is almost always left to a person.
That is where the problem starts. Threat volume grows thousands of times faster than an analyst can read; the one that matters is lost among the thousands that do not. By the time a leak is noticed, the attack has often already happened — because there is a human between finding it and fixing it.
radar takes on the third stage as well. Detection, correlation and response are one chain: the decision is made at machine speed and the action runs inside the customer's own perimeter, within agreed legal limits.
| Stage | Typical XTI / CTI | radar |
|---|---|---|
| Observe | Collects artefacts, returns a list of indicators | The same, but the sources are regional |
| Understand | Adds context to the indicator, writes a report | Context is bound to your assets and your sector |
| Act | Hands it to a person — reactive, manual | Automatic: IAM, firewall, takedown |
| State | The event is logged and stays there | A risk is either open or resolved — nothing in between |
| Correlation | Every module files its own report | Four sources converge into one conclusion |
An exposed VPN on its own is a vulnerability. A leaked administrator password on its own is an incident. An attacker active against your sector on its own is a statistic. All three at one organisation inside one week is an imminent breach.
No single module sees that. The customer gets one conclusion rather than four separate reports — and every conclusion arrives with what to do about it.
These frames are from the radar console itself — the Honeypot Security organisation, on its own domains.
External security posture on one screen: the overall risk score, critical and high findings, vulnerabilities under active exploitation and the prioritised issue list.
Inventory of assets, subdomains and services — risk score per domain, expired certificates and the time of the last scan.
Opening an asset draws its full relationship graph: subdomains, IPs, ports, certificates, ASNs and hosting providers. Distance in the ring is distance from the target. The graph is built from scan results — no extra requests are sent.
Malicious infrastructure under watch: IP and URL indicators, the malware family they belong to, risk score and confidence level.
A caught post, opened: which term matched it, the model's classification and confidence, and the analyst's decision — confirm, mark harmless or reject. The post body is deliberately blurred here: it is a criminal advertisement.
radar produces intelligence and acts on it. The three triggers below can run fully automatically.
| Trigger | Automatic action | Result |
|---|---|---|
| Leaked password | IAM auto-reset | Sessions revoked, MFA enforced |
| Clone or phishing site | Automatic takedown | Blocked in the browser, complaint filed with the registrar |
| Attacker C2 or source | Firewall / EDR auto-block | The SOAR playbook fires |
Regional phishing, fraud schemes, forums and language.
Not an alert — an action. No queue behind a human.
Data residency built for regulator and bank requirements.
Substantially cheaper than a global platform.
Local language, local team, fast onboarding.
radar is built for security teams, so the platform itself is held to the same standard.
| Control | How it is implemented |
|---|---|
| Encryption | Full encryption in transit — all data protected |
| Enforced MFA | Multi-factor authentication is mandatory for every user |
| Immutable audit log | Every login, search and change — in a log that cannot be rewritten |
| Invitation only | No open sign-up — an administrator creates the account |
| Data residency | Data stays in country — aligned with regulator and bank requirements |
The platform console runs at its own address: Open the console
Your domain and the brand names you want protected. There is no agent to install and no network access required — the discovery, intelligence and brand modules work from the outside. Autonomous action needs an integration on your IAM, firewall or SOAR.
You set the limits. Every trigger has three modes: notify only, act on confirmation, or fully automatic. Most customers put takedown and firewall blocking on automatic and keep IAM reset on confirmation. Every action taken stays in the log.
Only inside your perimeter and in your name: a password reset in your IAM, a block on your firewall, a registrar complaint about clones of your brand. radar does not touch infrastructure that is not yours.
Closed forums, paste sites, dark web markets and infostealer logs. Findings are not purchased and not redistributed — only the part that belongs to your organisation is shown to you.
radar is not there to replace it. Global platforms cover regional sources, local language and local fraud schemes poorly. Most customers run both: the global one for breadth, radar for local depth and autonomous response.
In country. That is deliberate, so it aligns with regulator and bank requirements; at the Enterprise tier a dedicated instance and regulator reporting are available as well.
Ask for a demo — we will show you a first view of your domain: the external surface and any exposed leaks. Nothing is changed at this stage.
