Weak Signal Detection & Threat Profiling

The signal that forms before the incident.

A layer that detects, correlates and contextualizes weak signals across public digital sources — for security, intelligence and institutional protection teams. Not another monitoring platform. The infrastructure that listens before the noise.

2,847 signals processed in the last 24h
UI · Operational consoleAPI · Signal streamMCP · Native agents
UIOperational console
#8821veiled threat · 3 sources
P1
#8819reputational narrative
weak
#8817leak · 847 records
review
API/v1/signals/stream
// contextualized stream { "signal": "#8821", "class": "veiled_threat", "conf": 0.87, "sources": 3, "corr": "E-7714" }
MCPagent · signal.subscribe
agent
Any new signals correlated to E-7714 in the last 24h?
presage
3 signals correlated. 1 escalated to P1. Mean confidence 0.79.
In action · live01 / 05

You hand over a fragment. The layer hands back the whole scene.

A post in a public network. Alone, noise. Presage expands that fragment into risk class, actors involved and the set of signals that haven't yet made noise — relinking what's scattered across sources that never spoke to each other.

Illustrative demonstration. Synthetic data for educational purposes.
Input
"...tomorrow he'll learn
to keep quiet."
Text fragment captured in a public forum, with no apparent target and no explicit threat.
Signal #8821 · Veiled threat
resolved across 3 layers · 4.2s
0.87
conf.
class
Veiled threat
layer
Behavioral
target
E-7714
actor
A-3208
11
sources relinked
04
signals correlated
01
P1 signal escalated
Without the layer, each of these signals would pass alone in any triage. Together, they form the scene.
Eight analytical layers02 / 05

The layers that make a signal readable.

Each signal passes through multiple analytical layers working in concert — inference, behavior, correlation, media, sources. The composition is what turns fragment into scene.

Weak signal · lexical drift
0.87
Veiled threat · target match
0.81
Behavioral · escalation pattern
0.74
Cross-source correlation
0.62

AI-assisted inference

Hybrid pipeline combining analytical rules, language models and contextual inference — every signal scored, classified and weighted automatically.

threshold

Behavioral intelligence

Profiles actors continuously, surfacing escalation patterns against a learned baseline.

E-7714

Contextual correlation

Relinks events, actors and content across sources — building context, not isolated alerts.

Forums Social media Telegram CT logs Paste sites Image boards Public archives News & media

Multi-source capture

Continuous ingestion across public digital sources, with scalable monitoring and contextual tracking.

image · IMG_4421.jpg
"...meeting at 22:00 at the usual place. bring the documents..."
↓ extracted & classified
veiled communication0.74

Media understanding

OCR and visual classification surface signals hidden in images and unstructured content.

P1
Veiled threat
Conf. 0.87 · 2 sources
now
P2
Reputational
Velocity +42%
2m
P3
Leak match
847 records
14m

Operational prioritization

Automatic ranking by criticality, context and correlated patterns.

Weak signals412
Threats94
Harassment62
Other47

Distribution by class

Effective coverage of the 9 operational classes — an immediate read of the active risk profile.

Three classes · one layer03 / 05

Different classes. The same friction.

Threat, reputation, leak — surfaces that look disconnected, except for the shared problem: the signal exists, but is scattered, weak and out of context. Presage solves all three the same way.

Case · 01veiled threat

What takes shape before the threat becomes explicit.

"Are these isolated posts the same escalation pattern?"

Each post passes any moderation. Presage looks at the space between them — lexical drift, temporal window alignment, deviations from the actor's baseline. The veiled signal emerges before the threat declares itself.

result
N scattered posts → 1 escalation pattern
Case · 02reputation

The narrative that assembles before the public damage.

"Is there a coordinated narrative forming against the entity?"

Sparse mentions are background noise. The layer cross-references velocity, semantics and source topology — revealing when the noise stopped being organic and started organizing. Before the visibility spike.

result
Scattered mentions → 1 coordinated narrative
Case · 03leak

The data that already circulates before the alarm goes off.

"Is this exposure new or was it already circulating?"

A dump appears. The interesting question isn't "what's in it" — it's how long it's been exposed, in which parallel sources, and what else was exposed alongside. The layer relinks the leak to the history it had already been drawing.

result
Isolated dump → 1 exposure history
Isolated signals rarely explain what's coming. Context does.
Operational principlePresage
Weak Signal Detection & Threat Profiling
The layer04 / 05

Four movements. Not steps.

State changes of the signal. Presage is the layer where public fragments become signals, context and priority — before any alert happens.

MOV. 01

Capture

Distributed public sources stop being islands. Everything converges into a single layer of continuous ingestion.

MOV. 02

Detection

Fragments start being read as signals — lexical, behavioral, visual — classified and scored in real time.

MOV. 03

Correlation

Distributed signals recognize each other — actors, targets, time windows, patterns that only exist when seen together.

MOV. 04

Delivery

The consolidated scene flows to where the operation happens — UI, API or agent via MCP. Priority, not queue.

2.8k
signals processed in a typical 24h window
operational average
04 / 07
signals already correlated before becoming alerts
11
sources relinked, on average, per escalated signal
09
risk classes covered by the detection layer
03
consumption surfaces: UI, API, MCP
Consumption · surfaces05 / 05

One layer. Three ways to access.

The same infrastructure, three surfaces designed for different roles — those who investigate, those who integrate, those who orchestrate.

UI

Operational console

Visual exploration of signals, actors and correlations in real time. Each signal opens the whole scene — not the notification, the scene.

UIactive signals · 24h
#8821veiled threat · E-7714
P1
#8819narrative · 47 mentions
P2
#8817leak · 847 records
P3
For those who investigate — intelligence, fraud and institutional protection analysts.
API

Operational stream

Contextualized signals delivered to pipelines, SIEMs and risk platforms via REST and streaming. You subscribe to the stream, the layer delivers it already correlated.

POST/v1/signals/stream
// correlated signal { "signal": "#8821", "class": "veiled_threat", "priority": "P1", "conf": 0.87, "sources": 3, "correlated": ["#8819", "#8814"] }
For those who build — security engineering, internal platforms, risk automations.
MCP

Native agents

Agents consume the layer without an adapter — just point to the infrastructure via MCP. The scene is already assembled, ready for autonomous reasoning.

MCPagent · signal.subscribe
agent
Any new P1 signal correlated to E-7714?
presage
Signal #8821 escalated. Veiled threat, conf. 0.87, 3 sources, actor A-3208.
For those who orchestrate — autonomous systems, analytical copilots, response automation.

The signal is already in the air. The context has to be built.

Presage is the infrastructure where public fragments become signals, context and priority — before your operation needs the response.