CREW INSIDER-THREAT MONITORING

ATLAS // CONTINUOUS OSINT // CREW INSIDER-THREAT MONITORINGCOLLECTION LIVE

Who really sits in your cockpit?

Continuous OSINT screening and monitoring of online activities of pilots and air crews, for airlines and regulators.

Request a briefing See a live case

atlas / collection feed{{ flagCount }} indicators today · demo data
UTCSUBJECTSOURCE · ACTIONLANGRESULT

            {{ pin.time }}{{ pin.name }}{{ pin.crew }} · {{ pin.role }}{{ pin.src }}{{ pin.lang }}{{ pin.status }}
          
              {{ r.time }}{{ r.name }}{{ r.crew }} · {{ r.role }}{{ r.src }}{{ r.lang }}{{ r.status }}
            
open sources only · 3 indicator categories · two-analyst verification

CASE-01 // THREAT MODELCLASS: OPEN-SOURCE · REV 2026.10

The insider with the controls.

Pre-employment vetting and periodic background checks capture a single point in time. Radicalisation, hostile recruitment and affiliation with terrorist organisations develop gradually, and their earliest indicators surface in open sources, often months before any change is visible at work. Continuous OSINT monitoring of what a crew member follows, shares, comments on and reacts to closes the gap between checks.

VECTOR 01RadicalisationA gradual shift, visible in what a subject follows, shares and reacts to well before it appears in what they post.

VECTOR 02Hostile recruitmentState and non-state actors approach aviation personnel through open platforms, groups and channels.

VECTOR 03Terror affiliationDirect or indirect links to designated organisations, their media channels and their fundraising.

Vetting answers who they were. Continuous monitoring answers who they are today, and tomorrow.

CASE-02 // COLLECTIONCLASS: OPEN-SOURCE · REV 2026.10

Collection coverage.

SRC-01●Instagramposts · reels · stories · comments

SRC-02●TikTokvideos · comments · likes

SRC-03●Facebookposts · reactions · groups

SRC-04●Xposts · replies · reposts · likes

SRC-05●Telegrampublic channels · comments

SRC-06●YouTubeuploads · comments · subscriptions

SRC-07●LinkedInposts · activity

SRC-08●Redditposts · comments

SRC-09●Threadsposts · replies

SRC-10●Snapchatpublic stories

SRC-11●VKpublic pages · walls

SRC-12●Open webforums · blogs · news · paste sites

ACTIVITY TYPESPosts, replies, reactions, reposts, follows and group joins, reels and ephemeral stories. Network signals carry as much weight as authored content.

CADENCENear-real-time where platform access allows; scheduled re-collection elsewhere. Full re-sweep every 24 h against updated designation lists.

PRESERVATIONCaptured on first sight: WARC, full-page render, media and metadata, SHA-256 sealed. Content later deleted by the subject remains in evidence.

CASE-03 // INVESTIGATION WORKSPACECLASS: OPEN-SOURCE · REV 2026.10

Full-spectrum OSINT on every crew member.

Identity resolution across social platforms, forums and channels, with continuous collection of posts, comments, reactions and media. Flagged content is matched to threat criteria and watchlists, with source, timestamp and hash-sealed capture.

1 2 3 4 5

1Agent workspaceAutomated collection tasks: name variants, watchlists, account discovery.

2Identity graphAccounts resolved to the subject, each with a confidence level.

3Evidence viewerOriginal content, translation, source URL, collection time, SHA-256.

4Source coverageWhat was and wasn't visible for this subject, per source.

5Identity match queueAnalyst confirms or rejects each candidate account. Every decision logged.

CASE-04 // LIVE CASE · F-1047CLASS: OPEN-SOURCE · REV 2026.10

One post. Six steps. One defensible case.

subject · CR-9142 · captain · meridian air{{ caseState }}

              telegram · public channel · [designated org.] · RU
              "New statement from the organisation. Share widely."
              subject commented: "Thank you for the work you do, brothers."
              captured 06 oct · 09:12:07 utc · warc + render + media
            

              attribution · confirmed
              instagram @ivan_p_air ✓ oauth · x @ivan_p_air ✓ oauth · telegram @ivan_p_air → photo hash + handle match
            

              indicator · links to terrorist organizations
              watchlist hit · designated org.
              pattern · 14 comments / 8 months
            

              analyst a · verifiedN. Levi · RU native · 09:31
              analyst b · second reviewD. Amar · 09:44
            
sha-256 {{ hash }}{{ sealLabel }}

              disseminated · 09:52 utc
              → meridian air · security officer · verified case + evidence
              → israel caa · inbound crew notice
            

1.84Mpublic items collected / day

52indicator matches to analysts

9verified by two analysts

9disseminated · illustrative day, 70,000 crew

CASE-05 // ATTRIBUTIONCLASS: OPEN-SOURCE · REV 2026.10

Attribution before assessment.

No content is assessed until the account is tied to the subject. Every link carries a confidence level, and low-confidence attributions are never disseminated.

CONFIRMEDControl verified via OAuth at enrolment.

HIGHCross-platform match: photo hash, handle, bio, location.

MODERATEPartial match. Analyst decision, logged.

LOWName-only match. Never disseminated.

CONFIRMED · 2instagram @ivan_p_airx @ivan_p_air

HIGH · 1telegram @ivan_p_air · 76%

MODERATE · 1reddit u/ivan_p_air · 61%

LOW · 1vk · name only · 37%

oauth · enrolment photo hash + handle username match name only

SUBJ CR-9142 · Captain Meridian Air · passport verified

CASE-06 // SAFEGUARDSCLASS: OPEN-SOURCE · REV 2026.10

Behavior, not identity.

INDICATOR CATEGORIES · FLAGGED

Incitement Support for violence Links to terrorist organizations

OUT OF SCOPE · NEVER ASSESSED

Religion Nationality Political views

No covert collectionNo sock-puppet accounts, no infiltration of closed groups, no access to private or encrypted content.

Two analysts, every flagSoftware never decides alone. A second analyst confirms; no one confirms their own work.

Measured error ratesFalse-positive rate tracked per language and per indicator category, reviewed monthly.

The airline decidesAtlas assesses. Airlines and regulators make the call.

COLLECTION LIMITSAbsence of indicators is not clearance. Private accounts, closed groups, encrypted messaging and content removed before first collection are outside scope. Reports state coverage per subject so the reader knows what was and wasn't visible.

CASE-07 // TRUST AND COMPLIANCECLASS: OPEN-SOURCE · REV 2026.10

Built for the people who audit you.

EVIDENCE HANDLINGAdmissible chain of custodyWORM storage, SHA-256 sealed captures, every access logged. Exportable with a custody record for legal proceedings.

ESCALATIONImminent-threat escalation15-minute notification target, 24/7, to the airline, the regulator and the national authority. Drilled every quarter.

PERSONNELVetted analystsCleared analysts with native-language capability; analyst location set per customer contract. Access is role-based, logged and reviewed quarterly.

DATA PROTECTION ^[1]Per-jurisdiction complianceProcessing under the data-protection law of each customer's jurisdiction (GDPR, Israel PPL, UAE and Saudi PDPL, Egypt PDPL), with a documented legal basis per customer, typically the destination regulator's requirement.

EU AI ACT · GDPR ^[2]Human oversight, no automated decisionsBuilt to high-risk AI requirements. Crew can request a human re-check; a privacy impact assessment is kept per customer.

RESIDENCYData residency and keysIsrael, EU or UAE regions. Customer-held keys. Retention set per policy; data deleted when a crew member leaves.

        [1] Including Regulation (EU) 2016/679 (GDPR); Israel Protection of Privacy Law, 5741-1981; UAE Federal Decree-Law 45/2021; Saudi Personal Data Protection Law (2021); Egypt Law 151/2020.
        [2] Regulation (EU) 2024/1689 (AI Act), Annex III and Art. 14; Regulation (EU) 2016/679 (GDPR), Art. 22.
        Roadmap: ISO/IEC 27001:2022 and SOC 2 Type II certification in progress; status available on request.
      

CASE-08 // PRICING · USDCLASS: OPEN-SOURCE · REV 2026.10

Pricing.

Per crew member, not per check. No charge per flag, per analyst hour or per source.

01 / NETWORKShared registryCheck any crew member's verified history across member airlines.Freefor every member airlineJoin the registryINCLUDES✓Cross-airline screening history✓Verified flags only, with category and date✓Every lookup logged

02 / PRE-HIREPre-hire screeningConsented OSINT review of a candidate before they join.$300per candidate, one-timeRequest a briefingINCLUDES✓Passport chip and liveness check✓OAuth account linking✓24-month look-back✓Signed report within 48 h

03 / ONGOINGcoreContinuous monitoringEvery active crew member, every day, for the whole career.$600per crew member per yearRequest a briefingINCLUDES✓Continuous collection across all sources✓Two-analyst verification✓Verified-case alerts and signed reports✓24/7 imminent-threat escalation✓Shared registry included

04 / SETUPOnboardingOne-time integration with your crew systems and identity provider.Scopedone-time, quoted after a scoping callBook a scoping callINCLUDES✓Fleet and crew size✓Crew system integration (joiners, leavers)✓SSO, jurisdictions, data residency✓Languages in scope

Final terms depend on fleet size and jurisdiction.

CASE-09 // BRIEFINGCLASS: OPEN-SOURCE · REV 2026.10

Request a briefing.

A 45-minute session with our analysts, for airline security teams and aviation regulators.

01Live demonstrationCollection, attribution and a verified case, on demo data or a consented crew sample.

02Legal basis for your jurisdictionApplicable data-protection law, regulator requirement and consent model.

03Integration scopeCrew systems, SSO, data residency and a setup quote.

      collection: nominal
      last sweep {{ sweep }}
      sources 13/13
      items today {{ items }}
      demo telemetry
    