Introducing Ardence: The OS for fighting crime
Today, we announced the launch of Ardence. Ardence is an AI investigation platform built for crimefighters. It helps investigative teams find relevant all-source intelligence, make sense of complex networks, develop findings they can examine and corroborate, and turn that intelligence into action.
We built Ardence to accelerate the investigative cycle: gathering intelligence, making sense of it and taking action. Our ambition is to help teams move from an initial lead to informed action in a fraction of the time, while keeping investigators responsible for the conclusions they reach and in control at every step.
Collect relevant intelligence
An investigation can start with a victim's report, a wallet, a domain or a question. The first task is deciding where to look.
Ardence Tradecraft brings methods developed by TRM's investigators and analysts into that work. Ardence proposes a research plan: what to establish, which sources to consult and what needs corroboration. Investigators can review and refine the plan, then guide the research as findings emerge. Users can also add their own skills and repeatable workflows, so others on the team can start with methods their specialists have developed.
The Ardence Data Network brings together TRM's blockchain intelligence and a network of leading intelligence providers including AML Ranger, APIVoid by NoVirusThanks, AsiaVerify, BankCheck, Bitquery, Bitsight, CACI DarkBlue, Castellum.AI, Censys, Cloudburst, ComplyAdvantage, Constella, Criminal IP, CYJAX, DarkOwl, Diligencia, District 4 Labs, Exorde Labs, Flashpoint, Fraud Intelligence Limited (FIL), Global Database, GreyNoise, Hudson Rock, Infrawatch, Kaiko, Kharon, Magnet Forensics, Malanta, Minerva, NewsCatcher, OpenCorporates, OpenSanctions, OSINT Industries, Overwatch Data, Parallel, PhishFort, Pipl, PolySwarm, sanctions.io, Scamalytics, ShadowDragon, Shadow Nexus, ReversingLabs, Shodan, Sigma7, Sixtyfour, smooth.sh, SOCRadar, SpyCloud, Team Cymru, TeamT5, Tesseract, ThreatFabric, Torchlight.ai, Vetric, Webamon, Whisper, WhoisXML API, WireScreen, and Xapien.
The network spans a broad range of intelligence, including blockchain activity, corporate and financial records, internet infrastructure and dark web activity. Teams access participating sources through a single TRM agreement, drawing down credits as they use data. Organizations control which available sources their teams can use, based on their mission, authority and data policies. Availability varies by customer and jurisdiction, and supplemental provider terms may apply.
Agents can pursue independent lines of research in parallel. One agent can trace a payment while another examines a website's infrastructure and another researches an alias. They bring the records back for review, saving investigators repeated searches and transfers between tools.
Make sense of complex networks
Manually connecting the dots and building a network graph can take days. With Graph Intelligence, investigators can work conversationally with an agent to build that picture and ask questions of graphs containing thousands of nodes. They can ask how organizations connect or what infrastructure sites share, then inspect the source information supporting those connections.
With Ardence Libraries, teams can upload prior investigations, reports, datasets and other files for new investigations to draw on. Each case added to a library gives the next one more context, helping teams map networks and prioritize threats as their knowledge compounds.
With Ardence Automations, investigators can schedule recurring research and receive a brief after each successful run or an alert when specified conditions are met. Teams can keep watch for new activity involving a set of accounts, companies or brokers while they pursue other leads.
Before relying on a finding, investigators need to be able to answer a basic question: how do we know this? Ardence Claims attaches evidence-and-explanation cards to relevant statements in an investigation summary. Investigators can inspect the supporting evidence, conflicting evidence when present, and the explanation and assumptions behind a claim. They can also open the source record and see who provided it, when it was retrieved and what it contained.
A shipment record's cargo description is an observation about the record. A suggestion that the shipment may conceal illicit goods is a hypothesis that needs further investigation. The investigator builds the case from the underlying evidence, checking what supports the hypothesis and what might rule it out.
Investigators use findings as a starting point for further inquiry and corroborate information through independent investigative work.
Turn intelligence into action
A finding can point to a scam website to take down or funds that may still be recoverable. Acting often means finding the right recipient and assembling the evidence they need.
With Ardence Disruptions, investigators can prepare, review and submit takedown requests from the evidence in their case. We're expanding these workflows to cover ten types of target, including scam websites, social media accounts, phone numbers and fraudulent ads.
The aim is to bring hours of preparation down to minutes. Investigators decide what to submit within their authority; receiving organizations assess requests and decide whether to act.
For cryptocurrency investigations, we're extending this approach to flagging addresses through the Beacon Network, helping investigators alert participating platforms to funds that may warrant intervention. Participating platforms review those alerts; any asset-freeze request follows the investigator's authority and the recipient's procedures.
Teams can also share sourced reports and graph exports with colleagues and partners, giving them records they can examine as they continue the work.
Built for AI-scale crime
Criminals are using AI to commit crime faster, at greater scale and at lower cost. Our Capacity Gap paper describes the growing distance between the crime society experiences and what investigators have the capacity to address.
The defining question for our generation is how investigators can meet the speed and scale of that threat while upholding the principles they are sworn to defend. We built Ardence to give the advantage back to crimefighters: more capacity to pursue leads and stop harm, with the evidence and judgment their work demands.
Request a demo to see how Ardence can support your team's investigations.
