In this demo
Seeded scenarios, fixed-rule triage, a parallel human request, and a brief that stays local until simulated consent.
Investor prototype
Cyber incident handoff
A clearer paththrough a cyber incident.
Structured intake, simulated AI triage, and a responder brief you consent to share with one fictional label.
Simulation only. Nothing is detected or dispatched.
Still planned
A vetted roster, signed capacity, a privacy program, and measured clocks. None of that runs here.
Describe. Assess. Prepare the handoff.
01
Describe
Tap what was seen, what is suspected, how wide it looks, and whether the device in hand is trusted.
- Ransom note
- Changed payee
- Unfamiliar admin
- Unknown
02
Assess
Fixed rules separate observations from hypotheses and list what is still unknown. This is not a diagnosis.
- Observation
- Hypothesis
- Unknown
- Simulated AI triage
03
Prepare the handoff
A minimum brief stays in the browser until you simulate consent for one fictional label. It is not broadcast.
- Consent
- One recipient
- Not sent
Synthetic cases in the console
Open the demoSynthetic BEC
Email payment change
Invoice detail and an urgent payment request.
Account takeover
Mailbox and MFA
Prompts the person did not start, plus an unfamiliar admin.
Ransomware
Ransom note
Files will not open. Supported here; a wider rollout stays gated.
Unknown
Unclear slowdown
No pattern is forced.
False alarm
Routine explanation
A possible ordinary cause. Not a clearance.
Bypass
Aid unavailable
Rules do not run. A person can still be requested.
A person, in parallel
Request a human while triage runs, skip triage, or continue when the aid is unavailable. Neither path waits on a result or a payment. No person is contacted.
- Request received. Logged in this browser only.
- Human acknowledgment. A simulated reviewer mark, not an analyst.
- Consent. Required before the minimum brief is marked shared.
- One label. Demo response team A, B, or C. Never a broadcast.
Five informational drafts
First actions, ransomware, account compromise, payment fraud, and a printable handoff worksheet. Direct downloads. Not certified guidance.
Try the simulated panic path.
Fixed-rule simulation. No model is called, and no person is contacted.
Explore the panic demoBuyer
The working hypothesis is a US organization of about 10 to 100 people, often an agency or consultancy on Microsoft 365, whose MSP lacks digital forensics capacity. That fit is not validated. The research note holds the buyer write-up, the competitor record, and the pilot list.
Operating model
A live service would vet firms, track real capacity, and keep payment off the path to guidance. Qualification and readiness are hypotheses. Monetization ideas, the concept-paper reconciliation, and sources are in the research note.