WYRMCYBER
A local security concept connecting asset records, cyber advisories and spatial observations. Bring the evidence behind an alert into context: the equipment affected, the service it supports and the events within a site.
Supporting tool areas
Tools informing the concept
Public-source research, asset evidence and vulnerability indicators provide complementary views of a security question.
Identity & OSINT
Review authorised public-source leads
Source associations carry uncertainty and require a permitted investigative purpose.
Username Search
Compare a supplied handle with approved public-source records.
Phone OSINT
Review authorised number metadata, with collection permissions and uncertain associations recorded.
Email Breach
Review approved breach indicators for an authorised address.
Image OSINT
Inspect permitted image metadata and provenance clues.
Threat Intelligence
Relate advisories to the assets they may affect
Dated indicators and source references for authorised review.
Threat Intel
Review dated threat indicators from approved sources, preserving provenance and duplicate or conflicting records.
CVE Monitor
Compare NVD, EPSS and CISA KEV snapshots with verified asset details.
Threat Feeds
Organise approved indicators such as hashes and domains.
Sanctions
Surface potential matches in approved sanctions snapshots for qualified review.
Recon & Attack Surface
Review the known external footprint
Approved inventory and exposure records, with collection boundaries kept explicit.
Recon
Review authorised domain and certificate records against the agreed asset inventory.
Network Scanner
Inspect authorised network-scan exports alongside service and asset records.
Attack Surface
Compare approved exposure records over time.
Google Dorking
Review permitted search results for potentially exposed records within an agreed scope.
Wayback
Compare dated public-site snapshots, preserving source references and gaps in the historical record.
Dark Web & Forensics
Keep exposure evidence traceable
Permitted source records and reproducible transformations for analysts.
Dark Web
Review lawfully obtained exposure indicators within a defined investigation scope.
IP Lookup
Use approved address, ASN and reputation records as context.
Data Toolkit
Apply defined transformations to authorised evidence copies, preserving the original and the transformation record.
See it in action
Two illustrative outputs from the toolkit
Illustrative examples of public-source associations and vulnerability indicators, with references alongside the findings.
Mapped one handle across 3,142 sites. 7 confirmed accounts, 2 inferred via metadata, 3,133 negative — typical signal density for an active dev / OSINT analyst.
Confirmed accounts (7)
Public profile · 412 posts · cyber-security focus
Public profile · 89 posts · DFIR / threat-hunting
Rate-limited (1)
Login wall — handle reserved but content not public.
Negative — top excerpts (2 shown)
- TikTok
- + 3,132 more sites returned no result
Premises Presence
Spatial evidence for secure areas
A spatial-security concept combining LiDAR geometry, Wi-Fi observations and optional thermal inputs. The focus is on occupancy, zone crossings and entry events, with a shared timeline for operator review.
Drag a figure to move it; hover a room for example occupancy counts. This scripted illustration shows zone events using animated figures. Health Watch previews a roadmap idea with scripted vitals; it is not a built feature and would need per-person consent.
Sensor choices
Complementary observations
Each sensor contributes different evidence. Coverage, calibration and privacy controls must be tested for the selected site.
Optical observations
LiDAR & optional thermal
- LiDAR supplies geometry and position observations
- Thermal may add person/background contrast
- Occlusion and reflective-surface context
- Maps and recordings may contain sensitive information
- Capture time and spatial alignment
Radio observations
Wi-Fi channel sensing
- ESP32 channel measurements
- Site-specific presence and movement patterns
- Room-level presence and movement observations
- Radio use requires site approval, even with wired backhaul
- Retain uncertainty when sensor observations cannot be associated
Spatial contexts
Three spatial contexts
Fixed, relocatable and moving platforms bring different geometry, timing and coverage considerations.
Phase 1
Fixed-zone feasibility
A fixed indoor zone brings geometry, access events and complementary observations into a shared coordinate frame.
- Defined observation area
- Surveyed coordinate frame
- Unexpected occupancy and zone crossings
- Possible tailgating for operator review
- Clock and calibration checks
- Degraded coverage made visible
- Operator-led access decisions
Phase 2
Relocatable deployment
A relocatable unit introduces site calibration, coverage and repeatable setup into the spatial workflow.
- Installation and recalibration
- Changed geometry and obstructions
- Power and communications loss
- Site-specific coverage
Phase 3
Moving-platform research
A moving sensor platform adds localisation, motion compensation and map alignment to the spatial record.
- LiDAR and IMU fusion
- Measured timing and map drift
- Local 3D events with uncertainty
- Observable movement and zone events
Local architecture
Processing inside the approved site boundary
Local processing
Local perception and event processing, with ESP32 observations linked to the site’s sensor record.
Time-aligned evidence
Capture timestamps, clock drift and calibration quality govern fusion. Stale observations remain visible as degraded coverage.
Bounded model roles
Specialised perception and defined rules detect events. The local LLM explains recorded evidence outside the real-time sensing loop.
Human authority
Security staff review events and determine the response. Identity, authorisation and intent are not inferred from physiology.
Who it's for
Built for the people doing the work
For teams responsible for the equipment, networks and physical spaces that keep a site operating.
Estate and facilities teams
Connect controller and gateway advisories to the assets and services they support, using an authorised inventory.
Protective-security teams
Review observable zone and entry events alongside the site’s access and occupancy context.
Site IT and OT specialists
Agree data transfers, permitted checks and network boundaries. Begin with approved exports rather than active OT probing.
Authorised analysts
Examine dated public-source evidence with provenance and uncertainty, keeping sensitive site context out of public queries.
Bounded monitoring concept
Evidence checks within an agreed scope
Asset details, dated advisories and defined checks form a traceable evidence chain for security investigation and response.
Asset evidence · Review
Review imported records
Use verified inventory and dated advisory snapshots. Flag uncertain product or firmware matches for a security specialist; a missing alert is not assurance of safety.
Approved monitoring · Changes
Review changes over time
Agree sources, cadence and allowed connections with the site authority. Keep external collection separate from sensitive local analysis and preserve the age of each observation.
Approved asset inventory
Link manufacturer, model and verified firmware to the affected equipment. Active probing requires separate permission.
Dated advisory matching
Compare approved CVE, KEV and EPSS snapshots. Product identity and evidence freshness remain explicit.
Authorised exposure review
Investigate relevant breach or public-source indicators within an agreed collection scope and data boundary.
Source-linked report
Explain the affected service, evidence and unresolved questions for an authorised security reviewer.
Concept scope
Two related security applications
Asset-linked cyber evidence and spatial sensing connect different observations with a local security record.
Asset evidence
Connect cyber exposure to operating consequence
Link an approved inventory to dated advisories and the building services affected. Start with imported records and read-only review.
- Verified asset and firmware identity
- Dated vulnerability evidence
- Source-linked findings and unresolved matches
- Authorised security review
Spatial security
Spatial observations and site events
Connect time-aligned LiDAR, Wi-Fi observations and optional thermal inputs with zone and access events.
- Local capture and processing
- Clock, calibration and coverage checks
- Observable events with uncertainty
- Separate security data and operator authority
Cyber connects asset-linked advisories and spatial events through local evidence, source references and operator review.