The platform
HUNTER™
HUNTER is not a chatbot. It is the operating environment through which students conduct investigations — semantic discovery, network analysis, evidence integrity, media provenance, hypothesis testing and coordinated AI collaboration, with a human accountable for every conclusion.
Train inside the system
Each technology assists the investigator.
None replaces the investigator.
The doctrine
HUNTER corresponds stage by stage to the HUNTERS method. Real investigations are recursive, so you can move backward and forward through the doctrine at any point in a case.
- H · HYPOTHESIZE
- State what you believe and what would disprove it.
- U · UNCOVER
- Discover material you did not know to ask for.
- N · NETWORK
- Map relationships and find the bridges.
- T · TEST
- Attack your own theory before anyone else does.
- E · EVIDENCE
- Make every artifact defensible.
- R · REFER
- Produce intelligence someone can act on lawfully.
- S · SAFEGUARD
- Protect victims, sources, minimization and limits.
The HUNTER intelligence stack
Eight instruments. One judgment.
REASON™
Investigative reasoning engine
REASON helps investigators think through fragmented information: what supports a hypothesis, what contradicts it, what is assumed, what is missing, and what alternative explanation fits the same facts.
A hypothesis is a question, not a conclusion.
SIGNAL™
Semantic intelligence discovery
SIGNAL is the transition from searching for words to finding meaning. Instead of requiring the exact phrase, it surfaces conceptually related material across the training corpus.
Find what you didn't know to search for.
CARTOGRAPH™
Network intelligence
CARTOGRAPH visualizes relationships among people, organizations, devices, accounts, wallets, domains, addresses, numbers, messages, transactions, locations, events, media and infrastructure — and reveals itself progressively as evidence accumulates.
The network was always there. You just couldn't see it yet.
PATTERN™
Pattern and relationship discovery
PATTERN compares large numbers of events, entities and relationships to surface unusual combinations. It is not a magic anomaly detector — it presents possibly important relationships for a person to judge.
Potential signals require human interpretation.
ORIGIN™
Digital-media provenance
ORIGIN moves students past “does this look fake?” to the harder question: what can we prove about where this evidence came from? Students compare photographs, screenshots, video frames, crops, alterations and reposts across devices and sources.
Observe. Compare. Corroborate. Prove.
CHAIN™
Evidence intelligence and integrity
CHAIN governs every artifact in every case: identity, source, capture context, custody, transformations, corroboration, human and AI confidence, and case association.
A clue is not intelligence until you can defend it.
SENTINEL™
Threat-observation environment
SENTINEL is a defensive and investigative teaching environment for network and device anomalies, spoofing indicators, unexpected connections and AI-generated attack patterns. It contains no offensive exploitation functionality.
What changed?
SHIELD™
Security assessment
SHIELD replaces unexplained risk scores with structured, inspectable security reasoning. Every rating exposes the reasoning that produced it.
Low / medium / high is not an assessment.
Hypothesis
Are these apparently unrelated identities controlled by the same organization?
- Same wallet clusterSUPPORTS
- Shared hosting providerUNKNOWN
- Distinct victim languagesCONTRADICTS
- Reused device fingerprintSUPPORTS
- No custody on E-019UNKNOWN
A confident model output is not a finding.
Search
"invoice fraud"
Exact phrase. Three results. Everything else excluded.
Signal
investigative concept: payment redirection
Semantically related clusters emerge — including the phrasing you did not know to type.
Find what you didn't know to search for.
The network was always there. You just couldn't see it yet.
- 01Clue
- 02Source
- 03Provenance
- 04Corroboration
- 05Analysis
- 06Confidence
- 07Defensible intelligence
A clue is not intelligence until you can defend it.
- · capture context
- · device family
- · compression history
- · crop geometry
- · repost path
- POSSIBLE COMMON ORIGIN — IMG-02 / IMG-03 · not yet proven
Observe. Compare. Corroborate. Prove.
No flashing alarms. The environment isolates the anomaly and asks the investigator what a normal baseline looked like an hour ago.
What changed?
Query → result
known query
known result
Investigative discovery
- unknown relationship
- SIGNAL
- PATTERN
- NETWORK
- HYPOTHESIS
- DISCOVERY
Search finds what you ask for. Intelligence finds what you didn't know to ask.
- Low≤35%
Single uncorroborated source
- Moderate36–70%
Corroborated, provenance gap remains
- High≥71%
Independently corroborated, custody intact
State your certainty honestly, or it is not intelligence.
Hunter™
Human judgment
- 01 · STUDENT proposes hypothesis
- 02 · THE ANALYST evaluates reasoning
- 03 · THE CARTOGRAPHER examines relationships
- 04 · THE ARCHIVIST checks evidence
- 05 · THE ORIGIN SPECIALIST examines media
- 06 · THE ADVERSARY challenges assumptions
- 07 · THE COUNSEL identifies boundaries
- 08 · THE BRIEFER organizes findings
- 09 · THE INVESTIGATOR DECIDES
The investigator decides.
The human stays in command
AI can process more. AI can search faster. AI can reveal patterns. AI can challenge assumptions. But an investigation ultimately requires judgment. Every HUNTER investigation keeps evidence, provenance, confidence and human accountability visible.
AI provides leverage.
Humans provide judgment.
One institution, four dimensions
A school
Where investigators are trained to a defensible standard.
A laboratory
Where human + AI investigative methods are developed and tested.
A technology platform
Where HUNTER intelligence systems are refined against real investigative pressure.
A talent network
Connecting HUNTER-certified investigators with organizations that need them.