Does the AI decide the outcome of the investigation?

No. DefenceCore gathers and organizes evidence and can recommend what may need review. It does not decide a person’s guilt, identity, or intent. The authorized investigator can inspect the supporting findings, source context, coverage, and limitations before making a decision.

How is this different from manual OSINT?

Manual OSINT is effective but does not scale — a single case can take an hour of pivoting across separate tools. An autonomous investigation runs those pivots automatically, so a defensible case can be produced at the speed of a queue, on every case rather than the few that earn the time.

What is linkage confidence?

Linkage confidence expresses how strongly the available evidence supports a connection between identifiers. The graph distinguishes stronger, corroborated connections from weaker investigative leads so reviewers do not have to treat every link as equally certain.

What Is an Autonomous OSINT Investigation?

Q: What is an autonomous OSINT investigation?

It is an investigation where software prioritizes and runs permitted evidence checks instead of requiring an analyst to operate every lookup manually. In DefenceCore, the analyst chooses a goal and starting identifiers, and the system runs a bounded two-stage workflow before returning a sourced answer, coverage summary, evidence list, and relationship graph.

An autonomous OSINT investigation is one where software gathers and organizes relevant evidence instead of requiring an analyst to operate every lookup manually. In DefenceCore, the analyst chooses the question the case should answer, provides the available identifiers, and receives a sourced overview, coverage summary, evidence list, and relationship graph. This guide explains what "autonomous" means for the user and where human judgment remains essential.

Manual OSINT, Briefly

Traditional open-source intelligence is a manual craft. An analyst starts with an identifier — an email, a phone number, a username, a wallet address — and works outward. A breach record surfaces an alternate email. That email, searched across platforms, surfaces a reused username. The username leads to accounts the subject never volunteered. Each step is a decision: what does this finding let me check next?

Done well, it is effective and defensible. Done at volume, it does not scale. A single case can absorb an hour of tab-switching across a breach checker, a carrier lookup, a chain explorer, and a handful of social sites. Most teams do not have that hour per case, so cases clear or decline on a hunch.

What "Autonomous" Means

An autonomous investigation moves the pivoting — the sequence of "given this, check that" decisions — from the analyst to a controlled workflow. Concretely:

You choose the goal. The case begins with a specific question about identity credibility, fraud or abuse, linked identity, or possible impersonation.
You provide the signals. One identifier or several: email, phone, username, IP, or crypto wallet.
The investigation stays focused. It gathers and organizes evidence relevant to the selected question.
It connects related findings. Discovered attributes remain linked to the submitted identifiers and their source context.
It resolves an identity graph. Discovered attributes are linked back to the same underlying identity, each connection carrying a confidence score.
It returns a sourced report. The goal answer appears first, followed by coverage, evidence, and an interactive graph for deeper exploration.

The analyst's judgment moves up a level: from running the lookups to reviewing the case the agent assembled.

What "Autonomous" Does Not Mean

This is the part that matters most for anyone acting on the output. Autonomy applies to the investigation, not to the judgment.

The system does not decide a person's guilt, identity, or intent. It organizes evidence and recommends what may need review.
The recommended action is workflow guidance. It is not a determination about a person.
Nothing is unsourced. Every finding cites where it came from, so a reviewer can check the agent's work rather than trusting it.

The design goal is an investigation that is fast and auditable: the speed of automation with the defensibility of manual work.

Goal-Based and Reviewable by Design

The goal tells the report what the analyst needs to understand. The overview answers that question first, highlights supporting evidence, and states important limitations. Coverage is shown separately so an incomplete investigation cannot be mistaken for a clear result.

The evidence list and interactive relationship graph remain available for deeper review, but neither is placed ahead of the case answer. Read Goal-Based OSINT Investigations for Fraud and Security Teams for the supported use cases and report experience.

Linkage Confidence: The Key Concept

The hardest problem in any investigation is not finding data — it is deciding whether a discovered attribute actually belongs to your subject. An autonomous system has to make that call explicitly.

Linkage confidence expresses how strongly the available evidence supports a connection between identifiers. The relationship graph visually distinguishes stronger, corroborated connections from weaker investigative leads so a reviewer does not have to treat every link as equally certain.

Why It Matters

For fraud, trust & safety, and compliance teams, the value is not "AI does OSINT." It is that a defensible investigation — the kind that used to require a trained analyst and an hour — becomes something you can run at the speed of your queue, on every case rather than the few that earn the time.

DefenceCore is built around exactly this model: question and signals in, a focused investigation, and a sourced answer out. Findings remain evidence for an authorized reviewer rather than an automated judgment about a person. See the sample report to view the structure on a fictional case.