Controlled AI. Real results.

Turn fragmented leads into a defensible case record

Public-sector teams are often forced to investigate across browser tabs, point tools, screenshots, analyst notes and disconnected reports. Arqent gives the work a governed case structure so every lead, source, artifact and reviewer decision can stay connected.

Human approvalSources attachedAirgapped ready

Product view

A case workflow, not another lookup screen

Signals, files, tool results, analyst notes and reviewer decisions stay attached to the same case from intake to final briefing.

Intake

Leads, files, source requests and case objectives

Collection

OSINT, dark web, internal data and governed tools

Analysis

Case graphs, entity context, source notes and reviewer checks

Output

Briefing, evidence package and decision trail

EVIDENCE TRAIL

Every result stays linked to its sources

A case workflow, not another lookup screen

What investigation teams get back

Faster first-pass triage

Move from lead intake to prioritized context without rebuilding the case across tabs and spreadsheets.

Less lost context

Keep sources, artifacts, enrichment steps, case graph relations and notes connected to the case.

Cleaner review package

Preserve source notes, tool outputs, reviewer decisions and report context for leadership or legal review.

Deployment-aware from day one

SaaS for evaluation, on-premises or fully airgapped for operations – decided before implementation, not after.

Where investigation work usually breaks

A lead starts in one system, an OSINT result lands in another, a dark web note is copied into a document, and the final report has to explain why the team trusted the conclusion. That handoff pattern is slow and difficult to defend.

Arqent keeps the work inside a governed case structure. Analysts can collect, enrich, correlate and brief while the system preserves artifacts, reviewer decisions and source context.

PROBLEM

Leads spread across tools

Analysts collect signals from OSINT, dark web, files and internal sources, but the investigation record becomes scattered.

WORKFLOW FIX

Context gets lost

Each lead, enrichment step, case graph relation, report draft and reviewer note stays attached to the case.

OUTCOME

Outputs must stand up to review

The end product is an evidence package with preserved artifacts, source notes and decision trail.

CONSTRAINT

Deployment boundaries vary

Start with SaaS for evaluation, then run on-premises or fully airgapped for operations.

Use cases

Government investigation workflows this supports

The same case model can support multiple investigative patterns while preserving evidence, access control and reviewer accountability.

Investigations

Case-native investigations

From the first lead to the final briefing, operators collect, enrich and correlate inside the case. Sources, findings, analyst decisions and reports stay in one record instead of chats, spreadsheets and point tools.

Explore workflow

Systems and sources

Case fileOSINT sourcesInternal data

What the operator does

Collection and enrichmentCorrelation in the case graphAnalyst review

Results

Case briefingEvidence packageDecision trail

OSINT

OSINT analysis

Operators collect and assess open sources – usernames, email registrations, domains, social and messaging channels including Telegram, and commercial OSINT such as Fivecast ONYX. Every hit gets a source note and a false-positive check before it becomes a finding.

Explore workflow

Systems and sources

Fivecast ONYXUsername and email checksTelegramWeb and domain sources

What the operator does

Collection under policyFalse-positive controlAssessment with confidence

Results

OSINT assessmentReviewed hitsSource notes

Threat intelligence

Darknet intelligence

Find and map onion services, marketplaces, vendors and indicators – with darknet search, an isolated Tor browser and analysis of the Tor relay network. Collection stays governed, and every artifact stays attached to the case.

Explore workflow

Systems and sources

Darknet searchIsolated Tor browserTor relay data

What the operator does

Onion discoveryMarketplace and vendor mappingRelay and operator analysis

Results

Relation graphEvidence artifactsThreat package

Financial investigations

Crypto wallet intelligence

Wallets found on the darknet or in seized material are analysed, linked wallets are traced and connected to actors, accounts and domains in the case graph.

Explore workflow

Systems and sources

BTC and ETH walletsDarknet context

What the operator does

Wallet analysisLinked walletsActor correlation

Results

Wallet graphActor contextCase report

Financial crime and compliance

Sanctions screening

Persons, organisations, vessels and aircraft are screened against sanctions lists. Matches, list entries and the reviewer decision are documented in the case.

Discuss this use case

Systems and sources

Sanctions listsCase data

What the operator does

Entity matchingHit reviewDecision log

Results

Screening reportDocumented decisionAudit trail

OSINT

Account and identity investigations

Username and account signals across platforms are compared, false positives are marked, and the remaining hits are connected into an identity graph with source notes.

Explore workflow

Systems and sources

Username searchEmail registrations

What the operator does

Cross-platform comparisonFalse-positive reviewIdentity graph

Results

Identity graphReviewed hitsEvidence notes

Digital forensics

Image and media forensics

Images are checked for metadata, hidden content and manipulation, text is extracted and translated, and a sanitized copy plus a signed evidence bundle go into the case.

Discuss this use case

Systems and sources

Images and screenshots

What the operator does

Metadata and steganography checksOCR and translationSigned evidence bundle

Results

Forensic reportSanitized copyEvidence bundle

Monitoring

Continuous monitoring

Operators watch targets, topics and sources on a schedule – day and night – and report only what changed, with the evidence attached. Repeated failures escalate to a person.

Discuss this use case

Systems and sources

OSINT sourcesDarknetEvent feeds

What the operator does

Scheduled runsChange detectionEscalation

Results

Change reportsAlertsWatch history

Classified environments

Airgapped intelligence

The full platform runs without any connection to the outside – with local models, local evidence storage and the same checks and approvals as everywhere else.

Explore workflow

Systems and sources

Local modelsYour infrastructure

What the operator does

Isolated operationLocal evidence storageControlled data transfer

Results

Local reportsAudit packageControlled export

Product view

Turn findings into connected case context

People, accounts, domains, wallets, locations, reports and source artifacts can be organized into a reviewable case graph instead of remaining isolated lookup results.

Entities

Actors, accounts, domains, wallets and locations

Artifacts

Files, screenshots, tool outputs and reports

Relations

Why one finding matters to another

Review

What was checked, approved and exported

CASE GRAPH

Findings become connected context