What can travel
- Malicious IP addresses, domains, URLs and file hashes
- A validated defensive lesson
- The context needed to judge relevance
Our vision
One discovery can strengthen a whole community.
Attackers reuse what works across many organisations at once. Our vision is a community where a threat validated in one organisation helps protect the others, while each keeps its own data, policies and decisions.
Knowledge travels. Authority stays with each organisation.
Create your account and start your guided onboarding.
A lesson informs participating organisations where it is relevant. Actions depend on local policy, permissions, connected controls and licensing.
- Validated before it travels
- Only attacker knowledge is shared
- Your policy decides
- Built in Europe
The starting point
Why start from zero after another team has learned?
Most lessons stay inside the organisation that learned them. Four questions decide whether a lesson can safely help anyone else.
Today: What did another defender discover?Findings usually stay inside the team that made them.
In the community: A validated finding can inform other participants where it is relevant.
Today: Was the lesson checked before it travelled?Unverified warnings create noise and wear down trust.
In the community: Findings are assessed with DCRE — Dynamic Confidence & Reputation before they are shared.
Today: Does it matter here?Generic threat feeds rarely say whether a threat applies to you.
In the community: Relevance is checked against each organisation's own environment.
Today: What does local policy allow next?Automatic action without consent would take control away.
In the community: Each organisation's policy decides: apply, ask for approval or record the gap.
A lesson's path
Knowledge travels. Authority stays local.
The shared part is a defensive lesson. What happens with it is always up to the organisation that receives it.
Discover
A participating organisation spots suspicious behaviour or confirms a threat.
Validate
The finding is checked, stripped of identity and personal data, and shaped into a lesson others can assess.
Inform
Participants where the lesson is relevant receive it as extra defensive context.
Decide locally
Each organisation's policy decides whether and how to act with its own controls.
What happens next
One lesson. Each organisation decides.
Pick an organisation and see why the same validated lesson leads to a different result.
Organisation A validates a phishing domainIllustrative example · not live activity
Choose an organisation
Result for this organisationProtection appliedThe domain is blocked through B's own controls.
B's policy allows automatic action for validated phishing domains, and its email control is connected.
Outcomes depend on relevance, local policy, permissions, supported controls and licensing.
The boundary
Shared learning never means shared control.
Taking part makes a useful lesson available. Every environment stays independent.
What stays with each organisation
- Names, users and identities
- Email content and files
- Policies, permissions and approvals
- Access to the environment
Defined participation
Knowledge moves through defined participation and governance, never without limits.
Your decision
A lesson informs your next step. Your policy decides what happens.
Honest status
Waiting approvals and missing controls are never reported as protection.
Who it helps
The same lesson, different ways of working.
Taking part does not require every organisation to work the same way.
- Small and growing businessesCommunity learning for a small team, without handing over control.For SMBs
- MSPs and MSSPsAssess a lesson across customer environments while each keeps its own rules.For MSPs & MSSPs
- EnterprisesAdd shared context to established controls, governance and response.For enterprises
How is this different from a threat-intelligence feed?
A feed delivers indicators. UnifiedONE validates a finding, checks whether it is relevant to each organisation and coordinates a response only within that organisation's policy.
Can other organisations see our data?
No. Sharing defensive knowledge does not give another organisation access to your environment. Names, users, email content and files are not shared.
Does a shared lesson trigger automatic action?
Only when your policy allows it. Otherwise the action waits for your approval, and a missing control is shown as a gap.
What does DCRE mean?
DCRE means Dynamic Confidence & Reputation. It weighs source reliability, recency and contradictory evidence before a lesson can be considered for sharing.
From idea to practice
Help build a community that learns together and decides locally.
Join the community to start guided onboarding, or see how the platform carries a lesson from discovery to your own decision.
Create your account and start your guided onboarding.