Canonical honeypot intelligence for AI/ML infra scanners. Signature DB + Go CLI + Python bridge. Subscriber model for shared fleet detection.

Technical OSINT Mining Engine. Canonical AI/ML platform corpus: 50 platforms with Shodan dorks at 3 tiers, aimap probe configs, OSINT profiles, confidence-scored passive fingerprinting.

Lifecycle-tracked findings ledger for AI infrastructure OSINT. Append-only SQLite store with ECS-inspired schema. Feeds VisorScuba.

Zero-knowledge external attack surface scanner for Google Cloud Platform. Five-phase scan with subset-sum attack-chain detection. Single Go binary, ~15s per host.

The NICE Cybersecurity Workforce Framework as a wardrobe of atoms. 1,281 atoms across 39 roles. Hand-pick tasks/knowledge/skills/abilities to assemble custom postures.

Authorization Context Analyzer. Describes code, systems, and behaviors by what they do versus what they assume the right to do. 14-sample reference corpus.

Offline semantic ranker: maps scanner findings to Metasploit modules in a single Rust binary. BERT encoder, 3,904 embedded modules, ~101 MB. Built for air-gapped networks.

Seed-polymorphic reconnaissance engine. Six seed types in (IP, CIDR, Domain, ASN, CertFP, BannerString), a typed provenance graph out with rule-based exposure classification and drift detection.

Single-host passive reconnaissance. One IPv4 in, one JSON report out. Reverse DNS, Shodan, TLS cert, crt.sh, threat graph, risk summary.

Process-injection detection benchmark for Windows x64. Two techniques (section/classic) plus a 6-tier HollowCorpus ladder. Sysmon HIT/MISS per event ID.

Portable Conversation State Embedding. Scores clarification overhead, compresses session history into an 8-dim calibration vector, builds a 7-dim L2-normalized embedding, SHA-256 fingerprints it for drift detection.