Production cadence
New indicators per day, last 30 — by category.
- C2
- Phishing
- Payload staging
- IAB
- Attribution
CICS · SENTINEL · PREEMPTIVE INTELLIGENCE
Adversarial infrastructure, observed before it lands.
NO HAFÄCHÄS. PREEMPTIVE SIGNAL.
What we see, when we saw it, and how far ahead of any public source.
3,106,013
Malicious predicted
5
Categories tracked
1,982
Public confirmations
23d
Median lead time
What this is
SENTINEL detects adversarial infrastructure during its staging phase — the days and weeks before an attack reaches anyone's network. The output is not retrospective IOCs but preemptive indicators of operations being prepared.
This page is the public record of that work: what was observed, when, and how many days ahead of the first public source. Each indicator carries a decay score that reflects how actionable it still is, expiring at a rate set by its type.
Indicators we produced
Four views on what SENTINEL is observing right now.
Lead time trend
7-day rolling mean of max public-source lead time, last 90 days.
Lead time distribution
How many days SENTINEL was ahead of the first public source, across all indicators.
0-4d
71
5-9d
139
10-14d
120
15-19d
229
20-29d
777
30-44d
629
45-59d
17
60d+
0
Corpus trail
Live coverage over the last 90 days — bronze is currently tracked, green is the cumulative burn record.
- Active
- Burned (cumulative)