Technical OSINT Mining Engine. Canonical AI/ML platform corpus: 50 platforms with Shodan dorks at 3 tiers, aimap probe configs, OSINT profiles, confidence-scored passive fingerprinting.

Canonical honeypot intelligence for AI/ML infra scanners. Signature DB + Go CLI + Python bridge. Subscriber model for shared fleet detection.

Lifecycle-tracked findings ledger for AI infrastructure OSINT. Append-only SQLite store with ECS-inspired schema. Feeds VisorScuba.

The NICE Cybersecurity Workforce Framework as a wardrobe of atoms. 1,281 atoms across 39 roles. Hand-pick tasks/knowledge/skills/abilities to assemble custom postures.

Authorization Context Analyzer. Describes code, systems, and behaviors by what they do versus what they assume the right to do. 14-sample reference corpus.

Zero-knowledge external attack surface scanner for Google Cloud Platform. Five-phase scan with subset-sum attack-chain detection. Single Go binary, ~15s per host.

Offline semantic ranker: maps scanner findings to Metasploit modules in a single Rust binary. BERT encoder, 3,904 embedded modules, ~101 MB. Built for air-gapped networks.

Seed-polymorphic reconnaissance engine. Six seed types in (IP, CIDR, Domain, ASN, CertFP, BannerString), a typed provenance graph out with rule-based exposure classification and drift detection.

Single-host passive reconnaissance. One IPv4 in, one JSON report out. Reverse DNS, Shodan, TLS cert, crt.sh, threat graph, risk summary.

Portable Conversation State Embedding. Scores clarification overhead, compresses session history into an 8-dim calibration vector, builds a 7-dim L2-normalized embedding, SHA-256 fingerprints it for drift detection.

Process-injection detection benchmark for Windows x64. Two techniques (section/classic) plus a 6-tier HollowCorpus ladder. Sysmon HIT/MISS per event ID.