Portfolio · tier one · top secret
Skunkworkz is where our tier-one projects get built: a threat graph, the tools on top of it, and now our own cyber LLM. Everything here is top secret, which is why each one has a public status page, a number and a date. Two people. Evenings. No adjectives without receipts.
See the projectsLive build logLive means you can open it today. Building means the status page tells you what happened last night.
Tier oneOur own cyber LLM. A 3-billion-parameter model reads a dossier from the threat graph and answers, or says the dossier does not hold it. 173 of 200 hand-written analyst questions this week; the live reader is at 170. Trained in rented three-hour bursts, measured every night.
Build log →
Tier oneThe threat graph everything else stands on. 24 feeds, CISA KEV, ATT&CK, abuse.ch and open-web scanning, correlated into one Neo4j graph with a live globe and a defence-condition readout.
ninjasignal.ninja →
Tier oneDark-web and threat-intel platform: leak-site watchlists, botnet command estates, an actor explorer that cross-references the graph, and the console where the Cortex model answers with citations.
ninjalabz.io →
Tier oneThe Daily at 05:05 UK and the Weekly on Mondays. The threat picture in plain English, generated from the graph, with the numbers that back each line. Also in French, where it outsells the English edition.
ninjalabz.io/daily →
Tier oneEarly chatter. CVEs heard on social and RSS before NVD publishes them, with the claim worded exactly as strongly as the evidence allows. One PHP pair was on the board 16 hours before the record existed.
ninjafusion.ninja →
Tier oneAttack-surface scanning that scans our own estate first, every day. Findings go into a casebook with a mean time to repair that we publish rather than estimate.
ninja.ing/ninjasabaki →
Tier oneNatural language to graph queries, in the Labz console and on Telegram. Switch it to the Cortex model and the answers come from our own weights, reading our own graph.
in the console →
Tier oneThe correlation engine behind raz0r.io, and the gate called VERDICT that every published rule has to pass. A rule that cannot show its track record does not ship.
raz0r.io →Three rules, applied to the model and to us.
A number goes public with its set size, its chance rate and its held-out method, or it does not go public. Three adapters sat on disk this week because 149 is not 171.
The model knows nothing. The graph knows everything. The model reads and answers, and refuses when the answer is not in front of it. No invented CVEs, no invented victims.
When four ideas go in at once and the score drops, nobody knows why. We learned this at full price on the 26th of October and wrote it down.
The Signal client is on PyPI under Apache-2.0 as ninjasignal, and the CLI ships as NinjaClaw. The graph, the models and the evaluation set are ours; the measurements are public.