Project Beacon
Brings together threat intelligence from multiple sources, normalizes it into a common view, and correlates it against an organization's own telemetry to prioritize what is actually relevant.
Product status
- Concept
- Prototype
- MVP
- Pilot
- Beta
- Production
- Scale
Problem
Security teams work with many intelligence sources and struggle to separate broad noise from what's relevant to their own environment.
Why this problem matters
Analyst time spent triaging low-relevance intelligence is time not spent on real incidents — a well-documented operational problem in security operations.
Solution
Normalizes threat intelligence from multiple sources into a common view, then correlates it against an organization's own environment to surface what's actually relevant.
Core capabilities
- Multi-source normalization
- Deduplication and lifecycle tracking
- Relevance scoring against connected telemetry
- Searchable results with export
Architecture
An ingestion layer normalizes external intelligence into a common model; a correlation layer scores relevance against connected telemetry; a web application surfaces prioritized, searchable results.
How it works
- 1Connect available threat intelligence sources.
- 2Intelligence is normalized and deduplicated into a common view.
- 3Optional telemetry connection enables relevance scoring against your environment.
- 4Analysts search, filter and export prioritized results.
Security model
- • Role-based access to indicator sources
- • Encrypted storage of ingested intelligence
Not yet independently assessed
Integrations
- • STIX/TAXII feeds
- • Planned: SIEM export connectors
Deployment models
Target customers
- • Security operations centers
- • MSSPs
- • Threat intelligence teams
Business model
Tiered SaaS subscription by feed volume and number of connected telemetry sources (indicative, not final).
Differentiators
- • Focus on relevance to the customer's own environment rather than raw feed aggregation alone.
Evidence
Product evidence
Product screenshots
Available on requestTraction
Feeds normalized
To be disclosed
Roadmap
now
Feed normalization core
Stable ingestion and normalization for the initial feed set.
next
SIEM export connectors
Push prioritized indicators into common SIEM platforms.
later
Automated response playbooks
Optional SOAR-style response actions for high-confidence indicators.
Team capability
Investor relevance
Threat intelligence tooling is a recurring enterprise security spend category; this product is an early proof point for the company's data-normalization and correlation engineering capability.