SENTINEL

Threat intelligence usually arrives too late. An attack lands somewhere, researchers extract the indicators, and you load them into your blocklist, by which point the attacker has rotated the domains, renamed the kit, and re-provisioned the hosts. You end up blocking ghosts. Yet every targeted operation has a preparation phase first: domains registered, servers provisioned, payloads staged, callbacks tested. For hours or days that infrastructure sits in the open, visible to anyone who knows where to look and invisible to every feed and signature in your stack.

SENTINEL works that window. It is Preemptive Threat Intelligence: pre-disclosure records of adversary staging infrastructure, found globally while it is still being built and flagged before any of it is used against you. Each record carries a lifecycle, a confidence basis, and a recommended action, so your SOC knows whether to block, sinkhole, or watch. It runs as a collaborative service, tuned against your real traffic through a deliberate detect-first observation phase before anything is enforced inline.

The intelligence is CICS-owned and held in Switzerland, beyond the reach of foreign access law, and we never warehouse it into third-party tooling, yours or anyone else’s. Every record is timestamped at first observation, so when public feeds later report the same infrastructure, the gap is our lead time, auditable against the public record. The methodology is proprietary and OPSEC-bounded, built over years. We do not publish marketing numbers; live detection statistics are public at sentinel.cics.ch. Count for yourself.