Threat intelligence
Learn from every agent, defend each one.
Reputation the whole network contributes to, model-scored threat classes your rules can target, and a behavioral baseline per agent. Each layer is fail-open, so intelligence sharpens decisions without ever blocking on them.
Cross-tenant feed · model-scored classes · per-agent baselines
How it fits together
Three layers, one decision.
Each layer feeds the same risk picture. Together they catch what a single call never could.
Cross-tenant reputation
An opt-in feed of card verdicts, protected by a k-anonymity floor and fail-open by design.
Model assessment
A model scores your riskiest calls and returns a threat class your rules can target.
Behavioral baseline
Per-agent normal for tools, risk, and active hours, with deviations flagged.
Network reputation
When one tenant flags a host, everyone benefits.
Verdicts are recorded anonymously with a k-anonymity floor. Once enough organizations have flagged a host, that shared judgment folds into your local risk on later preflights.
k-anonymity floor at 5
Network judgment
tools.shadyvendor.io
Network raises your risk to 90
Model-scored
A second opinion on your riskiest calls.
High-risk and critical calls are assessed by a model that returns a threat class and a calibrated score your policies and response rules can target.
Use it in a rule
Behavioral
Every agent has a normal. We learn it.
After about twenty calls the platform knows an agent's usual tools, risk, and active hours, then flags a new tool, a risk spike beyond mean plus three sigma, and off-hours activity.
Observed call
baseline: 84 callsnormal band 0 to 52 (mean + 3σ)
usual hours 13:00 to 21:00 UTC
What the baseline flags
- mediumnew tool
first-ever call to "aws.s3.delete"
- highrisk spike
risk 80 far above its baseline (mean 22)
- lowoff hours
active at 03:00 UTC, outside its usual hours
Closing the loop
Intelligence becomes a predicate.
None of this is a separate dashboard to watch. A threat class is a first-class predicate in the rest of the platform.
Keep exploring
Continue across the control plane.
Turn every agent's behavior into a defense.
Share what the network learns, score your riskiest calls, and catch the agent that suddenly acts unlike itself.