FORGE — Investigations
Every other pillar produces findings. FORGE is where findings become documented, auditable action — a record designed to stand up to scrutiny in front of an inspector general, a court, or an oversight board. Complete auditability, from intake to authenticated export.
The problem it solves
Findings have to survive scrutiny
Most organizations run investigations on spreadsheets, shared drives, and email. Ticketing systems track work — but they aren't intelligence-aware, and they have no evidence chain of custody.
Status quo
With FORGE
Status quo
Spreadsheets and shared drives — no audit trail, version chaos.
With FORGE
Entity-centric case records with complete audit trails.
Status quo
Cases opened days after the triggering signal, if at all.
With FORGE
Automated case creation at APEX risk thresholds — manual initiation always available.
Status quo
Evidence authenticity impossible to prove later.
With FORGE
SHA-256 hashing, tamper detection, and authenticated discovery export.
Status quo
Reports of foreign contacts, incidents, and ethics matters landing in inboxes.
With FORGE
AI-guided intake with classification, priority, and routing.
Status quo
CI, cyber, HR, and legal each investigating in a silo.
With FORGE
Cross-domain investigations in one case, on one timeline.
Modules
Three modules, initiation to defensibility
A case backbone, a front door for reporting, and an evidence integrity layer — auditability is built into the workflow, not bolted on after it.
Modules
01
FORGE CaseOps
Unified intelligence case management
Cases open automatically at risk thresholds, with entity-centric timelines and Scribe-assisted documentation throughout.
The case is entity-centric: organized around the people, assets, and programs involved, with every known signal on one chronology — not a flat ticket with attachments.
Human role
Investigators run the investigation. CaseOps removes the administrative drag.
02
FORGE Intake
Automated reporting and triage
AI-guided reporting for foreign contacts, incidents, and ethics matters — classified and routed automatically to the right workflow.
Intake reports are signals too — they flow into APEX and can corroborate OBSIDIAN assessments.
Human role
Reviewers receive triaged, complete reports; reporters get a guided, low-friction path that encourages reporting.
03
FORGE Chain
Evidence integrity and data provenance
SHA-256 evidence hashing, tamper detection, and a complete audit trail with authenticated export for legal and IG proceedings.
Every access and transfer is logged. Classification here means platform access controls within the case system, with authenticated export for legal discovery.
Human role
Investigators and counsel rely on Chain to make the record provable — integrity is automatic, not procedural.
One arc, initiation to defensibility: the threshold trips, the case appears assembled, Scribe drafts the summary, Chain exports the authenticated record.
Ecosystem
Connected across the system
FORGE works standalone — manual initiation and intake are always available. The pillars make its cases richer and faster.
Stands on
APEXRisk thresholds, entity resolution, orchestration, and governance drive automated initiation and enrichment.
Receives cases from
OBSIDIANInsider risk patterns at threshold open cases automatically, evidence attached.
Receives cases from
LUCIDCritical open-source events implicating protected entities arrive through Pulse.
Receives cases from
STRATUMCyber-insider nexus findings that warrant investigation become cases with the digital evidence in custody.
Receives cases from
PATHWAYAn in-travel emergency SOS activation creates a case automatically — response and record at once.
Documented by
AI FORCEScribe drafts case summaries, timelines, and evidence catalogs as work proceeds. Investigators verify and sign.
Investigators
Cases pre-built with intelligence attached, administrative work automated, evidence integrity by default.
Analysts
A structured destination for findings — signals become cases, not emails.
Supervisors
Task status, deadlines, escalations, and workload visibility across the caseload.
Leadership
A defensible, audit-ready investigative posture with visibility into program health.
Legal and compliance
Chain of custody, classification controls, and authenticated discovery export.
Next step
Make every finding defensible.
A demo runs the full arc — automated initiation, the entity timeline, Scribe's draft summary, and Chain's authenticated export.