When the attack is over,
the investigation begins.
identiqa Intelligence supports law enforcement agencies, cyber-units, and prosecutorial offices with forensic-grade investigative tooling. Court-admissible evidence handling, attribution analysis, dark-web monitoring — built under European jurisdiction, restricted to verified institutional users.
Three problems
investigators tell us they live with.
Cyber units across European law enforcement face the same structural challenges. Underfunded, under-tooled, and asked to deliver court-admissible work product against increasingly sophisticated adversaries.
"Our tooling is five years behind the threat."
Cyber-criminal infrastructure, ransomware affiliates, and state-sponsored actors evolve quickly. Investigative tools procured through traditional public procurement cycles routinely lag behind by years. Modern AI-assisted analysis closes that gap — when investigators are given access to it.
"Evidence has to hold up in court."
Investigative findings without proper chain-of-custody documentation are worthless at trial. Our forensic tooling produces output formatted for court admissibility under EU evidence frameworks, with cryptographic integrity verification and full audit trails of every investigative action.
"Attribution is hard. Nobody helps with it."
Linking technical indicators to specific threat actors requires cross-correlation across thousands of campaigns. Most agencies don't have access to that breadth of data. Black Iris AI provides attribution analysis with confidence scoring and supporting evidence chains that prosecutors can defend.
Three capabilities investigators most often request.
Initial engagements with law enforcement agencies typically focus on one or two of these. Full Intelligence portfolio access is granted progressively as the institutional relationship establishes.
Forensic Analysis
Deep technical analysis of compromised systems, malware artefacts, and network traffic. Output formatted for court admissibility under EU evidence frameworks. Full chain-of-custody documentation included.
Attribution Analysis
Technical and behavioural attribution to specific threat actors. Confidence-scored findings with supporting evidence chains. Cross-correlation across past campaigns and known infrastructure. Defensible at trial.
Dark Web Monitoring
Continuous monitoring of dark-web marketplaces, leak sites, and threat-actor channels. Tailored to specific investigations: target identifiers, victim organizations, criminal-actor handles. Reporting fits investigative workflows.
From inquiry to operational engagement.
Engagement starts with verification. We don't process unverified inquiries; institutional confirmation comes before substantive technical conversation.
Initial inquiry from institutional address
Use a verifiable agency or ministerial email domain. Anonymous, personal-domain, or unverified senders are not processed. Brief context only — sensitive case specifics belong post-NDA.
Institutional verification
We confirm institutional affiliation through standard channels. Typical turnaround 2–5 business days. This step is non-negotiable, even for inquiries with apparent urgency.
Mutual NDA
Bilateral non-disclosure agreement signed before substantive technical discussion. Compatible with most national procurement frameworks. We support customer-led legal review processes.
Technical briefing & engagement scoping (60 minutes)
Specific use case, expected output, integration requirements with your existing investigative toolchain. Output is a written engagement proposal covering scope, deliverables, and procurement-ready terms.
Questions investigators typically ask first.
Is your output really admissible in EU courts?
How does the verification process actually work?
Where does the data live, and who has access?
Can we share findings with international partners (Europol, Interpol)?
Do you have references we can speak to?
What if we're not sure whether this is a fit?
Ready to start the conversation?
Submit an inquiry from a verified institutional address. Verification, NDA, and a substantive technical briefing follow — typical timeline two to three weeks to first operational engagement.
