CSI

Most security tools answer one question: what is broken in this system? They scan, they find holes, they hand you a list of holes. That is useful, but it is not what most people actually lose money to.

CSI answers a different question: what happened, and where did the money go?

Think of a break-in at a shop. A scanner tells you which window was weak. A detective tells you who came in, what they touched, what they took, where they went, and which parts nobody can explain yet. CSI is the detective, for online fraud and computer break-ins.

CSI also works before anything happens. The same evidence discipline finds issues and helps secure a system: an audit engine with 47 rules and evidence-bound findings, dependency checks that name what they cannot see, and a decision gate that refuses an unproven remediation claim. Find the issue, secure the system, and if something still happens, reconstruct it.

CSI stands for Cyber Security Investigation. Forensics, hack reconstruction, and tracing are hidden inside that, as parts of one method. Monitoring and analysis sit beside them: watching a system, reading what it shows, and following a case as it develops, not only after the fact. It is not a crypto tool either: crypto is a financial rail now, like bank transfers and card payments, and it is read the same way. Cases differ, and the method adapts. Where value moves, the case is mapped as a chain; a break-in where nothing was taken still reads the same reconstruction, the early stages filled in with evidence and the later ones left honestly dark.

Where value moved, the case is mapped as a chain of six stages:

Bait → Break-in → Control → Taking value → Washing it → Cashing out.

A phishing email is the bait. A stolen login is the break-in. The attacker sitting in a bank account is control. Moving the money out is taking value. Bouncing it through mule accounts is washing. Withdrawing it is the exit. CSI fills in as many stages as the evidence supports, and it is loud about which stages are still dark.

Every claim must carry its receipt. If CSI says this domain belongs to the same attacker, it also stores exactly where that came from and a fingerprint of the evidence, so anyone can check it later. No receipt, no claim.

Not knowing is a written-down answer. Most reports quietly skip what they could not confirm, and the reader assumes it was checked. CSI lists those as open gaps. Silence is never allowed to look like clean.

The machine checks, the AI suggests. Judgement is where software usually drifts. So the AI proposes what to look at next, but fixed, boring, exact code decides whether something passes. The AI never gets to be the judge of its own homework.

Three parts, cleanly separated: the workshop (the code and documents, kept in version control), the case room (evidence, notes and case records, kept private, never in the code repository), and the lab (throwaway virtual machines where anything risky gets tested, never on a real network).

It also refuses to be reckless with the internet. Every outbound request travels through a chosen road, your own connection, a private tunnel, an anonymising network, or a rotating set of rented servers, and the road used is recorded with the evidence, so a report can say how each fact was obtained.

CSI started as BlockIntel, focused on understanding what happens on chain. Then came the OSINT work, tracing what people and addresses reveal in open sources. As the cases grew, the blockchain work became a tool inside a bigger world rather than the world itself: a chain is just one rail, next to bank transfers, cards, and everything else a case can touch.

CSI is not a rename: it is both of them, folded into a single cyber security and investigation system. The intelligence and open-source digging you may have seen before now live inside it, as tools among others.

These are the system's own measurements, dated 2026-10-24, shown as it is: working, in build, and next.

Working: a deterministic code-audit engine with 47 rules that keeps findings evidence-bound; dependency reachability that reports named gaps for ecosystems it has not measured instead of guessing; a decision gate that refuses a "remediated" claim without evidence; evidence hashing with tamper checks; an isolated investigation lab with a live web target behind a verified network wall; a blue-team monitoring sensor on that lab; a case graph with lifecycle stages and a memory subsystem; and passive OSINT collectors, certificate transparency, RDAP, RIPE, web archives and urlscan, that run through an anonymised lane and record rate limits instead of hammering endpoints.

In build: deeper chain tracing, the transaction layer that follows value past hop zero; egress measurements across every road the system can take, written down lane by lane; wider monitoring and analysis coverage, so a system can be read continuously and not only case by case; and the agent loop, where the AI proposes the next look while fixed code keeps the verdict. The final yes or no stays with the person who owns the case.

Everything on the market is crowded into the find-the-flaw, open-a-ticket lane. Nobody sells the explain-the-event-and-follow-the-money lane. That is the business: small incident-response teams, fraud investigators, insurers, people who need a defensible story of what happened, with evidence attached, not another spreadsheet of bugs.

That is CSI: an investigator, not a scanner.

Last verified Oct 25, 2026

Role

A proprietary system for explaining online fraud and computer break-ins, with evidence attached.

Method

Cases differ, and the method adapts. Where value moves, the case is mapped as a chain of six stages, filled in as far as the evidence supports.

Judgment

The AI proposes what to look at next; fixed, boring, exact code decides whether something passes.

Access

Not a public product, not self-serve, and not shared. This page showcases the method.

CSI is not sold, licensed, or shared. There is no signup, no pricing page, and no request line. This page exists to showcase the method.