From a whisper to a warning.
An indicator on its own is trivia. Heimdall's tradecraft is the chain that turns it into a warning someone is responsible for — and the discipline to show how it got there.
The chain of attribution.
Five links, none skipped. Break the chain anywhere and it’s an opinion; keep it whole and it’s evidence a director can act on.
- IOCIndicator▮▮.▮▮▮.▮▮.▮▮
- INFInfrastructureAS▮▮▮▮▮
- ORGOrganization▮▮▮▮▮▮▮▮▮
- SECSectorFINANCE
- NATNationGH
Values redacted — the shape of the tradecraft, never the contents
Interrogate the whole record.
Years of findings answer in seconds, in plain language, with the evidence chain attached to every sentence. The analyst asks; the record testifies.
Where it listens.
Public records
Registries, certificates, routing tables — the paper trail infrastructure leaves behind.
Community intelligence
What the world's defenders share with each other, weighed and cross-checked before it counts.
The places attackers trade
Observed at a distance, never touched — the markets where stolen access changes hands.
The institutions themselves
Their perimeters, read the way an attacker would read them — with permission, for their defence.