SIEM tells you what happened.
We tell you what happens next — and keep score.

The first detection and decision layer that scores its own forecasts in public. Every answer carries the path the graph walked to reach it, so it survives an audit. We never hold your telemetry.

TIER 0 — no key, no card, no sales call

$ curl -s "https://api.raz0r.io/v1/ransomware/victims?limit=5" | jq
{
  "count": 5,
  "victims": [ { "victim": "…", "group": "qilin", "country": "NL", … } ]
}

10.5MGRAPH NODES

62.5MRELATIONSHIPS

355THREAT ACTORS

0BYTES OF YOUR TELEMETRY

SCORED

Every forward-looking output is registered in VERDICT with a probability and a resolution date, and the Brier score is public — including ours. No threat-intel vendor has ever done this. It is the only claim a competitor cannot copy without two years of history.

GRAPH-NATIVE

The graph reasons; the model speaks last. Answers arrive with their traversal path attached, not as an assertion you are asked to trust.

ZERO-MIGRATION

Detection executes inside your Sentinel or GuardDuty, under your credentials. Nothing to migrate, nothing to procure, no data-residency conversation.

Tiers follow cost, not a calendar

Each tier is defined by what a call costs us.

TIER	ENDPOINTS	PRICE
TIER 0	/v1/ransomware/* · /v1/actors/* · /v1/ownership/* · /v1/verdict/* Precomputed and cached. Marginal cost is a cache read.	Permanently free. No key. Not a trial — it never gets a paywall.
TIER 1	/v1/enrich · /v1/correlate · /v1/predict · /v1/brief Bounded graph traversal, occasionally a model call.	1,000 calls/month free, no card. Over-quota calls are not blocked. Metering is announced 90 days ahead.
TIER 2	/v1/detect · /v1/hunt · /v1/respond Compiled to KQL or GuardDuty filters and executed in your tenant.	Priced from day one Cost scales with your data — and lands on your cloud bill, not ours.

The retention rule, stated publicly: for Tier 2 we hold a short-lived credential, issue a query, receive a result set, enrich it, return it, and retain nothing but the query hash, a timestamp, a result count and an error class. No findings. No field values. No identifiers. That constraint is the business model, not a limitation of it.

Issue yourself a key

No sales call, no approval step. Shown once — only its SHA-256 is stored.

⚠ Store this now. It is not recoverable — we keep only the hash.