Talon by HawkSight

AI threat assessment, verified by the analyst

Talon is the AI threat assessment skill in HawkSight Nexus. It starts where every good adversarial threat assessment starts: with the subject, the organisation, site, project or event you need to protect.

From there it identifies the threat actors likely to have an interest in that subject, assesses their intent and capability, and maps recorded crime around the site. A sourced draft threat picture arrives in minutes, ready for the analyst to question, refine and confirm.

Available now as an add-on to the HawkSight platform, with the Talon threat assessment skill in HawkSight Nexus due for release in the new year.

HawkSight Talon Risk Intelligence product graphic with hawk emblem

How it works

From subject to sourced threat picture

  1. Define the subject. The analyst sets the scope, the threat vectors and any proprietary context, such as prior incidents or internal concerns.
  2. Build the context. Talon researches the site, its location and its regulatory environment, for the analyst to verify and lock.
  3. Identify the threats. Talon names the likely threat actors, assesses their intent and capability, and cites every source.
  4. Verify and confirm. The analyst questions the findings in the reviewer chat, overrides where needed, and confirms the final picture.

Why it matters

Specific, sourced and fast

A generic threat picture tells you what is out there. Talon tells you who might act against this site, this event or this organisation, and whether they could.

In our worked example, context and threat identification together took under ten minutes, against an estimated four to five hours by hand. The time saved goes back to the analyst for judgement.

Physical, cyber and human threats are assessed together, because real risk does not respect those boundaries.

Map of police-recorded crime around Millennium Square, Leeds, with a single violent crime record open showing its outcome and source link

Crime mapping and analysis

Official data, mapped around your site

Talon maps recorded crime around every site you assess, using official sources:

  • UK: street-level crime data from data.police.uk
  • US: FBI Uniform Crime Reporting (UCR) data

Incidents are clustered by location and can be filtered by source, threat vector and period, and every point links back to its official record. The data is also normalised into a per-capita Crime Threat Index, now built into Talon, so sites can be compared fairly across a portfolio.

Where the intelligence comes from

A controlled, configurable set of sources

Talon draws on a controlled set of sources rather than the open internet:

  • more than 750 multilingual news and intelligence sources, aggregated daily
  • government advisories, such as MI5, Counter Terrorism Policing and UK and US travel advice
  • sector sources, such as UK Finance and the NCSC
  • official crime data from data.police.uk and the FBI

Every finding cites its sources, and the source set can be tailored to the requirements of each analyst and client.

Talon threat table listing 13 threats with actor, intent, capability and threat level, with a UK Police Data source tooltip

The analyst stays in control

Human judgement at machine speed

Every Talon output is a draft until the analyst has verified it. Its suggested threat level sits beside the analyst’s own, so you can see at a glance where you agreed and where you overruled it.

In the reviewer chat, the analyst can question any finding. Talon works through the evidence, comes back with a sharper answer and updates the assessment. The analyst can always override it, but a short exchange usually reaches a more accurate answer, fast.

Read the full worked example →

Part of HawkSight Nexus

Where threat fits in the risk triangle

A threat on its own tells you little about risk. HawkSight assesses risk through three questions, the security risk triangle:

  • Assets: what are you protecting?
  • Threats: what are you protecting them from? This is where Talon works.
  • Controls: how vulnerable are they?

In HawkSight Nexus, the threats Talon identifies are mapped to the assets they could affect and tested against the controls in place. The result is a risk profile you can defend in front of leadership, with the analyst reviewing and accepting each stage.

Talon is available now on the current HawkSight platform, and the Talon threat assessment skill in HawkSight Nexus is due for release in the new year. Like the rest of the HawkSight platform, it will keep improving through extensive testing and feedback from our testers and clients.

Talon pricing

£495 per month ex VAT

One fee per account, covering your whole organisation. It is not a per-user licence.

Talon is available now, added to an active HawkSight SRM licence (Starter, Professional or Enterprise). Crime mapping with UK and US data is included with any HawkSight licence.

Contact us to add Talon to your account or to arrange a walkthrough on a subject of your own.

HawkSight SRM Ltd (Co. No. 09135227) is a UK-registered security risk management company. Not  affiliated with hawksight.co or hawksight.ai.

Shopping Basket