# Wahukeza · Preemptive Threat Intelligence > Threat intelligence platform with its own sensors, for banks, service providers and security teams. Correlate 40+ sources, enforce on your firewalls. Source: https://wahukeza.com/ Preemptive Threat Intelligence for banks, service providers and security teams ## Tip of the spear. Your own sensors meet the attacker first, including replicas of the very devices you run, cloned by a capture engine. What they see becomes blocklists your firewalls already speak, takedowns of the fake pages aimed at your customers, and the evidence your regulator asks for. On your premises, as a tenant we operate, or both. [Book a demo](https://wahukeza.com/contact?intent=demo) [See packages](https://wahukeza.com/pricing) On-prem or hosted · multi-tenant · unlimited analysts The SOC wall, captured from our own sensor network. Every dot and row is a real attacker. - [40+ intelligence sources](https://wahukeza.com/platform/sources): Built-in integrations, reviewed presets, generic TAXII/MISP/CSV connectors and first-party channels - [17 sensor personas](https://wahukeza.com/platform/sensors): Device clones, Linux CLIs, Ivanti, MCP, SAP, web stacks, SQL Server - [20 indicator types](https://wahukeza.com/platform/intelligence): IP to JA4, plus IBAN, phone number, SMS sender ID and app package - [1 command to clone a device into a decoy](https://wahukeza.com/platform/sensors#capture): Capture, anonymise, package for amd64/arm64/armv7. From host, user and password - [20 exposure rules](https://wahukeza.com/platform/attack-surface): Takeovers, mail auth, certificates, exposed panels and databases, CVEs - [1 database per tenant](https://wahukeza.com/solutions/mssp): Not a shared schema with a filter on it The loop ## The loop most tools leave open. Aggregating feeds is table stakes. Owning the collection, the enforcement output and the feedback path in one product is not. 1. 01 ### Sense Decoys, managed endpoints and phones, reported phishing and outside-in discovery of what you expose meet the attack first. [How it works](https://wahukeza.com/platform/sensors) 2. 02 ### Correlate Every observation joins 40+ sources in one deduplicated, scored, STIX-native graph. [How it works](https://wahukeza.com/platform/intelligence) 3. 03 ### Enforce Blocklists, takedowns, TAXII, SIEM and tickets in the formats your stack already speaks. [How it works](https://wahukeza.com/platform/enforcement) 4. 04 ### Sight Edge devices report what they blocked; recency and confidence are re-scored from reality. [How it works](https://wahukeza.com/platform/enforcement#sightings) 5. 05 ### Validate Observed TTPs become safe, reviewed procedures and a coverage-gap report for your controls. [How it works](https://wahukeza.com/platform/emulation) Why Wahukeza ## Five things you can check, not five adjectives. [### Own sensors, not rented feeds A fabric of device-faithful decoys (FortiGate and MikroTik, an Ivanti gateway, SAP NetWeaver, an MCP server) meets the attacker before your customers do, outside and inside your network. A capture engine clones the devices you actually run into new decoys. Every session, credential and payload becomes indicators you generated, and a ledger shows which ones were new.](https://wahukeza.com/platform/sensors): Unlike aggregators, which read the same public CTI you do.[### One graph from 40+ inputs Built-in integrations, reviewed presets and generic TAXII, MISP and CSV connectors flow through one write path with your sensors, endpoints and customer reports: deduplicate, correlate, score, allowlist, alert.](https://wahukeza.com/platform/sources): Unlike a SIEM with three feeds wired in, which cannot tell you which source to trust.[### Enforcement your firewalls already speak Blocklists in Palo Alto EDL, Fortinet, Suricata, DNS RPZ and nginx formats with ETag polling, and sightings back from the edge so confidence reflects what was actually blocked.](https://wahukeza.com/platform/enforcement): Unlike a portal you read, which never closes the loop.[### Licensed per installation, not per analyst Every package is an annual licence per installation or tenant with unlimited analysts. MFA, API keys and a hash-chained audit log are in all of them; a database per tenant isolates every client of a provider.](https://wahukeza.com/pricing): Unlike per-seat licensing, which charges you for every analyst you add.[### Sovereign because of where it runs On-prem, nothing goes to us: the licence is a signed file verified offline, AI runs locally, on your own key or not at all. Or take a tenant on Wahukeza-operated instances with its own database, or both, and change your mind later.](https://wahukeza.com/platform/deploy): Unlike vendor-hosted SaaS, whose region is not an answer to a compelled-access request.[Read the whole argument](https://wahukeza.com/why): Why Wahukeza, including the objections we lose on. Sense first ## Device-faithful, not a banner on a port. 17 personas across devices, gateways, servers and applications. Real management UIs captured and replayed; command lines emulated as a bounded command tree, where every outbound verb is answered and never performed. What gets past the login wall is what we learn from. The device clones come from our capture engine: one command turns a real device’s web interface into a decoy, crawled, anonymised and packaged. [Tell us what your estate runs.](https://wahukeza.com/platform/sensors#capture) [Explore the Deception Fabric](https://wahukeza.com/platform/sensors) - ### Captured device clones 7 personas Real management interfaces captured and replayed; FortiGate and MikroTik add an emulated vendor command line over SSH. - FortiGate - Management UI (443) - FortiOS CLI (SSH 22) - Telnet (off by default) - MikroTik RouterOS - WebFig (HTTP 80) - RouterOS CLI (SSH 22) - Telnet (off by default) - Sophos firewall - Admin console (4444) - Aruba 1930 - Web UI (HTTP 80) - Huawei B320 - HiLink web UI (HTTP 80) - Dahua IP camera - HTTP · MJPEG / snapshot (80) - RTSP over TCP (554) - UniFi OS console - HTTPS-only TLS door (443) - WebSocket replay - ### Linux command lines 3 personas A bounded command evaluator in three shapes. Never a real shell. - Linux server - SSH (22) - Telnet (off by default) - Linux compute bait - SSH (22) - Telnet (off by default) - Embedded Linux (BusyBox) - SSH (22) - Telnet (off by default) - ### Remote-access gateway 1 persona The SSL-VPN portal attackers hunt first. - Ivanti Connect Secure - SSL-VPN portal (HTTPS 443) - ### AI-agent server 1 persona A decoy MCP server for the scanners now enumerating them. - MCP server - Streamable HTTP (80) - Streamable HTTP (8000) - Legacy SSE - TLS (optional) - ### Enterprise application 1 persona The SAP path scanners kept asking our fleet for. - SAP NetWeaver AS Java - HTTP (80) - AS Java (50000) - ### Web-server stacks 3 personas Three server stacks, three synthetic sites, a cited lure catalogue. - nginx - HTTP (80) - Apache - HTTP (80) - IIS - HTTP (80) - ### Internal only 1 persona For decoy groups inside your network. Any persona can be zoned internal. - SQL Server - TDS (1433) SSH and Telnet background noise is caught by the Cowrie hive. Fleet management is desired state: digest-pinned images, signed configuration, health-confirm self-revert, rotation, heartbeat, and NAT exposure stamped on every event. One console, every client ## A database per tenant. Not a shared schema with a filter on it. Every client gets its own database, its own background jobs and its own branded report on a schedule. The operator control plane sits above them and never queries across them: roll-ups go through the API, by design. Provider licensing is by arrangement, through the partner programme. - Tenant isolation Database-per-tenant, tenant-resolution middleware, unknown tenant is a 403. - Unlimited analysts No per-seat charge. MFA, scoped API keys and a hash-chained audit log in every package. - Per-client deliverables Scheduled, branded reports e-mailed as PDF or pushed by webhook; attribution and targeting reports with Advanced AI Intelligence. - Collective immunity One sensor meets the attacker; every tenant gets the block. [For MSSPs & MDR providers](https://wahukeza.com/solutions/mssp) Operator control planePlatformOperator - client-01 db · jobs · report - client-02 db · jobs · report - client-03 db · jobs · report - client-04 db · jobs · report - client-05 db · jobs · report - client-06 db · jobs · report Roll-ups aggregate through the API and shared intelligence moves through the exchange, never through cross-database queries. Sovereign because of where it runs ## Your hardware. Your database. Nothing comes back to us. A cloud region is not an answer to a compelled-access request. Self-hosted, Wahukeza runs where you put it (a rack, a private cloud, an air-gapped segment), with no call-home and a licence verified offline. It fetches public data such as CVE records and advisories by default, and every external fetch can be switched off. Prefer us to run it? A hosted tenant gets its own database on a Wahukeza-operated instance, with Trony Network as processor under the DPA. - AI:Provider local | anthropic | none Chosen at install: a local model, Anthropic with your own key, or off. The stock configuration will not start on a hosted provider without a key; with AI off, Ask still answers from retrieval, with citations. - Retrieval postgres fts “Ask your intel” is grounded on Postgres full-text search. No hosted embedding service. - Data subjects export · erase Attacker IPs are personal data. DSAR export and erasure are screens, not tickets. - Supply chain cosign · sbom Images and chart signed with our own cosign key, CycloneDX SBOMs, checksums for every file, drilled upgrades and restores. [Deploy, identity & trust](https://wahukeza.com/platform/deploy) [Security & trust centre](https://wahukeza.com/security) The first-party feed, graded ## A scorecard you can hold us to. A daily job grades the platform’s own first-party feed (corroboration, uniqueness, allowlist collisions) from its own data, with nobody editing the result. Give-to-get keys, sector scoping and poisoning counters keep the exchange honest. The values shown are a sample. They will be replaced by the real figures when the public scorecard goes live. [How the scorecard works](https://wahukeza.com/scorecard) first-party feed · qualitysample values · not live - Corroboration62% share of mature exchange observables reported independently by at least two instances - Uniqueness37% share of the feed with no evidence from any third-party feed the deployment ingests - Allowlist collisions0.4% share of the feed that matches the allowlist (lower is better) case #2291 · DORA assessmentMajor Criteria met: critical services affected · clients affected · data losses - Initial notificationmet · filed in 3 h 10 min - Intermediate reportat risk · due in 9 h - Final reporton track Board report EN · CNR Audit log hash-chained Evidence pack controls map Illustrative incident. Drafted and recorded by the platform; filed by you through the authority’s portal. Evidence for the regulator ## They don’t ask whether you have threat intelligence. They ask you to show it. A declared incident is assessed against the DORA and NIS2 criteria by rules you can read, and a major or significant outcome starts the reporting clocks. Notifications are drafted from the case and recorded when you file them. Your board gets a scheduled report in English or Montenegrin, and your auditor gets a tamper-evident audit log and an evidence pack with a controls map to DORA, NIS2 and ISO/IEC 27001. - DORA - NIS2 - SEC cyber disclosure - APRA CPS 234 - MAS TRM - HIPAA - PCI DSS - CMMC - ISO 27001 - SOC 2 [Regulatory evidence & audit](https://wahukeza.com/platform/regulatory) [For regulated industries](https://wahukeza.com/solutions/compliance) Objections, answered ## The questions a technical buyer asks in the first call. Including the ones we only partly win. Why not OpenCTI? For a single team, use it. For a service provider it has no native multi-tenancy, and organisation segregation is an Enterprise Edition feature; one instance per client is exactly the overhead you are trying to escape. And it has no sensors of its own. Why not MISP? Keep MISP. We interoperate with it: MISP feeds in, a MISP feed out, and sharing groups that push and pull over the MISP REST API. But hosting it properly is an infrastructure project and it ships a dozen or more upgrades a year. We are the operating layer above the standard, not a replacement for it. Shadowserver is free. Take it. It is excellent. It gives you daily reports about your own netblocks. It does not correlate them with your other sources, tell you which exposure is being probed on your own sensors this week, produce enforcement-format output or a branded deliverable. Attack Surface Management does the outside-in view from seeds you prove you own. Self-hosting is an operational burden. Then choose. Run it on-prem (Docker Compose on a VM, or Helm for high availability), take a tenant with its own database on Wahukeza-operated instances, or combine the two. Models can be changed later, with export in STIX 2.1, CSV and JSON. On-prem ships with a migration runner, signed images with SBOMs, and upgrade and restore drills as release gates. Honeypots only see internet noise. Low-interaction ones do. Ours are high-interaction personas: cloned management UIs and command lines, an Ivanti Connect Secure gateway, SAP NetWeaver, a decoy MCP server, a camera that streams. The device clones are replicas of real devices built by a capture engine that records the management surface of the kit you actually run, not hand-written fakes. Exploit watch maps sessions to a cited catalogue of named exploitation campaigns, so you see which ones are aimed at the kit you run. How do I know your sensors can’t be turned into a foothold? Attacker-facing code cannot execute or dial out: static tests forbid exec, subprocess, eval and any outbound client in the transports, the login wall, the web, lure and TDS modules and the Dahua, MikroTik, Ivanti, MCP and SAP modules, and each CLI engine has its own security suite. Every outbound verb (wget, curl) is answered, never performed. UDP is never served, so a sensor cannot be a reflector, and uploaded bodies are stored inert. How much? Four packages (Basic, Standard, Advanced, Complete) and every module except the two AI modules can be licensed on its own. Each is an annual licence per installation or tenant with unlimited analysts. Pricing follows a short scoping workshop, because sensors, endpoints and delivery model are what move it. Packages ## Four packages. Every module also on its own. An annual licence per installation or tenant, with unlimited analysts. Pricing follows a short scoping workshop. ### Basic Your own intelligence picture, and blocklists for the protection you already have. 2 external + 3 internal decoys - Core Threat Intelligence - Deception Fabric - Regulatory evidence & audit ### Standard Protects customers and staff. 5 external + 5 internal decoys - Everything in Basic - Brand & fraud protection - Phishing Reporting ### Advanced Sees what you expose and automates the routine. 5 external + 5 internal decoys - Everything in Standard - Attack Surface Management - Automated Playbooks - Enterprise Identity (SSO, SCIM) - AI Threat Analysis ### Complete The whole platform. 5 + 5 decoys; endpoints and devices per quote - Everything in Advanced - Advanced AI Intelligence - Endpoint Intelligence & Response - Mobile Endpoint Protection & Notifications - Adversary Emulation MFA, API keys, a hash-chained audit log and signed releases are in every package. Every module except the two AI modules can be licensed individually; Availability & DDoS detection is licensed separately. [Book a scoping workshop](https://wahukeza.com/contact?intent=workshop) [See every package and module](https://wahukeza.com/pricing) Origin > On the Plains, the lance (_wahúkeza_) was carried by the rider at the point. Not the one who watched from the ridge; the one who closed first. > > That is where we put the platform. We are the tip of the spear, so your customers and clients never have to be. Wahukeza (wah-HOO-keh-zah): Lakota for “lance”. [Book a demo](https://wahukeza.com/contact?intent=demo) [Read the origin story](https://wahukeza.com/about)