About GuardianVigil & The IntelStack Ecosystem

The problem we kept running into was not a shortage of threat intelligence. It was that the intelligence arrived as a list. A few hundred addresses and hashes, no relationships between them, no indication of which source believed what or how strongly — and no way to tell whether the twelve hits in front of you were one campaign or twelve coincidences.

The tools that solve this properly are priced for organisations with a threat intelligence team. The tools priced for everyone else are, for the most part, a spreadsheet with authentication. Neither group tells you why it reached a verdict.

So we started building IntelStack: a platform that scans an indicator against twenty providers, shows which one contributed each point of the score, and stores what it observes as a graph rather than a row. Two people — Dharrmin Suthar on security research and engineering, Dixit Kumar on product and interface.

We have made this mistake ourselves, repeatedly, which is most of why we are opinionated about it. Twelve separate times a failure path in our own scanner returned a clean verdict when a provider call had failed — a green badge manufactured out of a timeout. Finding that twelfth instance is what turned an implementation detail into the thing the product is actually about: a system that says unknown when it does not know, and can always show you why it said anything else.

We fund the build with threat research and security engineering work rather than investment. That makes us slower than a funded team and means we can decide what gets built on technical grounds, which is a trade we are happy with.