Operation Mirage — one day at a bank on AIState

Why this matters. Every bank can buy the same AI models; what none can buy is what the bank itself knows. The film follows one day at an illustrative bank, Meridian, where a cyber incident and a fraud turn out to be the same story.

Features shown

Scene by scene

1. 
   0:06

   The exposure and the fraud were the same customer.

   Hi everyone, I'm George, from the product team at DataFab. Let me take you through one day at a bank, from first light to the close, on AIState. First, why it matters.

2. 
   0:22

   Why it matters

   Every bank can now buy the same AI models. What no one can buy is what the bank knows: who its customers really are, how they connect, what its experts decided last time. Today that knowledge is scattered across dozens of systems, and split between teams that never see each other's screens.

3. 
   0:47

   The usual answer

   The usual answer is a programme. Move the data into a new platform, remodel it in someone else's schema, bring in the vendor's engineers, and wait quarters before the first decision is governed. Then pay every year to keep the copy running and the engineers on site.

4. 
   1:10

   The opposite route

   DataFab takes the opposite route. AIState reads every system where it lives, inside the bank's own boundary. Every system of record stays where it is, and stays authoritative. It resolves what the data means into one governed knowledge graph, and it lets the bank's own people compose the agencies that do the work.

5. 
   1:38

   Owned by the bank

   What builds up is the bank's own: its Artificial Proprietary Intelligence. It works with any model, it grows with every decision, and it never leaves the building.

6. 
   1:52

   Operation Mirage — the day's timeline

   Today's case is Operation Mirage. One darknet seller, a stolen password dump and a list of people to target. A login wave at dawn, a fake trading app, fourteen mule accounts, and a money trail across three blockchains. Security sees a cyber incident. Fraud sees mules. We'll watch one graph see one story — and we'll watch exactly where it stops.

7. 
   2:24

   Meridian Bank · illustrative

   Everything you'll see runs on the platform. The bank is Meridian; every name, wallet and amount is invented.

The ground everything stands on. The analyst signs in and the Knowledge Fabric shows the bank’s estate — its detailed walkthrough is the last chapter. Then the systems are connected, graded and read into the model, and the Studio shows the agencies built on top.

Features shown

Scene by scene

1. 
   2:36

   Signing in

   Now I'm going to log in to the system.

2. 
   2:43

   The Knowledge Fabric

   Everything here starts from the Knowledge Fabric, the core of AIState. It connects every source the bank has, reads each one where it lives, and keeps its access control. We'll have a dedicated walkthrough of it at the end of this video.

3. 
   3:05

   Meridian's estate: 10 internal · 7 external · 0 rows copied

   Start with the ground under everything: the Knowledge Fabric. This is Meridian's estate as AIState sees it. Ten internal systems — core banking, cards, authentication, onboarding, payments, the document store — and seven outside sources: chain analytics, darknet monitoring, threat intelligence, a Telegram monitor, a consortium list. All read in place. Zero rows copied.

4. 
   3:39

   Allocating the sources

   I'm allocating the data sources from the Knowledge Fabric to my workspace: ten of the bank's own systems and seven outside sources, each read where it lives. Nothing is copied.

5. 
   3:54

   Source registration: grade, legal basis, fingerprint

   Every source is registered with a manifest: what it is, what the bank may use it for, and its legal basis. And every source is graded twice — how reliable the source is, and how credible this piece of information is. Two axes, never collapsed into one score. A finding built on a source nobody approved cannot be used.

6. 
   4:21

   Connector catalogue

   Connectors are how the Fabric reaches a system. Some are built in; some the bank authors itself.

7. 
   4:33

   The chain-analytics connector

   This one reaches the blockchains, so we can look up wallets as we go.

8. 
   4:41

   The Knowledge Fabric: the systems it reads, catalogued

   Then the Fabric discovers and catalogues what it has read: schemas, lineage, quality, sensitivity.

9. 
   4:49

   A source read into the model; types proposed

   It reads each field by what the values look like — this is a customer, this is an IP address, this is a device — and proposes a model of the estate.

10. 
    5:02

    A person approves the model

    A person approved that model once.

11. 
    5:09

    Resolved customers: 48,112 records · 217 queued

    Next, resolution. Forty-eight thousand customer records, each resolved to one customer. Two hundred and seventeen it wasn't sure about — and it queued them for a person rather than guess.

12. 
    5:27

    Document reading: per-field confidence

    Extraction brings in what sits in documents. The identity documents behind every account are read where they sit in the document store, each field with its confidence. No second copy.

13. 
    5:44

    Four entity types added

    Adding cyber took four new entity types — indicator, sighting, wallet cluster, attribution — on the same resolved customers the financial-crime team already uses. No migration. No new store.

14. 
    6:03

    Agencies and their autonomy levels

    On top of the graph sits the Studio. Here the bank's own people composed eleven agencies from its operating package, six of them reused from the financial-crime utility. Each runs at the autonomy level the bank chose for that process, and the bank can change it at any time. They act within policy. The effects your authority matrix reserves, such as a freeze or a block, wait for a person.

15. 
    6:35

    The two contexts, side by side

    And two contexts: how fraud reads a customer, and how security reads the same customer. They're owned, versioned definitions — not two copies of the data. You'll see why that matters.

16. 
    6:52

    Build record: 6 weeks · 4 people from the bank · no migration

    That's the foundation, and here's what it cost to extend. The cyber utility — four entity types, five new agencies, two contexts — was composed by four people from the bank's own team in six weeks, on the estate it already ran. No migration project. No vendor engineers on site.

17. 
    7:19

    Built on the Knowledge Fabric

    This entire operation is built on the Knowledge Fabric. Here is the estate graph: every entity and every relationship the bank can see, on one canvas.

18. 
    7:34

    A little closer

    Let's look a little closer.

19. 
    7:42

    In three dimensions

    The same estate, in three dimensions.

20. 
    7:51

    On the map

    And on the map: where it all sits in the world, indexed in real time.

21. 
    8:00

    On to the investigation

    Now, let's go to the investigation.

The analyst builds one investigation from the sources the workspace already reads, and drives it through the AIState Dialog rather than by hand. Overnight the agencies find, type and corroborate; at dawn they propose — and a person decides.

Features shown

Scene by scene

1. 
   8:11

   A new investigation, from our own sources

   Now I'm going to create an investigation from my sources. It will discover all the entities, and every connection between them, into one graph.

2. 
   8:24

   Pick what it reads

   I pick what it should read: the login attempts, the payments, the mule accounts, the chain, and the two darknet listings.

3. 
   8:35

   One graph

   Each source is read where it lives. Nothing is copied.

4. 
   8:43

   The graph builds

   The graph builds source by source, as each one is read where it lives.

5. 
   8:54

   The Dialog drives the investigation

   Rather than going through a big graph by hand, I'm using the AIState Dialog to drive the investigation.

6. 
   9:03

   The dump: 38 customers · persons exposed to raw material: 0

   Now the day. Credentials for Meridian's domain go on sale on a darknet market. The monitoring agency reads the listing through its manifest; no person ever sees the raw material. The resolver turns the password hashes into thirty-eight of the bank's customers. Nothing acts. The findings wait, marked for restricted sharing.

7. 
   9:33

   The resolver's overnight finding

   The same seller lists two hundred and twelve retirees with verified income. Nobody is woken. The resolver agency compares the new list with the dump overnight, and holds the seller as one entity.

8. 
   9:51

   While it works

   What it finds is written as your policy allows: applied where it may, proposed where you reserve it.

9. 
   9:57

   While it works

   Every answer is drawn from the graph the bank's own sources built.

10. 
    10:03

    What the resolver found

    This is what it found. Nine customers are on both lists, and one seller is behind both listings: vellum nine.

11. 
    10:14

    Anyone can ask the Dialog

    In the morning, anyone can ask the Dialog to show the same thing.

12. 
    10:20

    Dialog answer; the nine highlighted on the canvas

    It analyses the whole graph and shows every step it takes, so every number can be checked.

13. 
    10:30

    While it works

    It works with the same permissions as the person asking.

14. 
    10:39

    While it works

    Each answer points back to the records it came from.

15. 
    10:48

    While it works

    It shows every step it takes, so every number can be checked.

16. 
    10:56

    The wave; the monitoring agency's count

    Four thousand eight hundred login attempts in nine minutes. Forty-seven get in. Nine are on devices the bank has never seen — six of them customers from the dump. The monitoring agency counts, for every address, how many different customers it got into.

17. 
    11:20

    Technique typed; second source confirmed

    Sixty-one addresses, each into dozens of accounts. That's credential stuffing. The technique is typed to the industry standard, and a second, independent threat-intelligence source confirms the network block. Corroborated — not attributed. Attribution has its own threshold.

18. 
    11:47

    The agencies propose, then they stop

    The agencies propose: step up authentication on nine sessions, block the network, push the indicators to the perimeter. Then they stop.

19. 
    12:00

    While it works

    What it finds is written as your policy allows: applied where it may, proposed where you reserve it.

20. 
    12:09

    While it works

    Every answer is drawn from the graph the bank's own sources built.

21. 
    12:18

    Ade Balogun signs in

    Now Ade Balogun from security operations signs in. Ade decides on the security actions the agencies propose: approve them, or decline them with a reason.

22. 
    12:33

    Ade Balogun lands

    Ade lands on a start page that holds only what security owns today.

23. 
    12:41

    An alert in the bell

    Nobody here goes looking for work. It arrives in the bell, at the top right.

24. 
    12:50

    What the alert says

    The alert says what is waiting, and on which case.

25. 
    12:55

    Straight to the case

    One click, and you are on the case.

26. 
    12:59

    The security gate: approved, declined with basis, pushed

    Ade in security disposes. Step-up approved. Block declined — it carries legitimate customers — with his reason recorded. A refusal is a decision too, and a regulator asks about both.

27. 
    13:23

    The push: two payments

    And one more thing. Before the gate, two payments had already left one victim's account. Monitoring has them.

28. 
    13:38

    While it works

    It works with the same permissions as the person asking.

The graph joins what no single system holds: one customer across four systems. The morning team signs in, each following the alert that brought them, and the case is raised, peopled and argued.

Features shown

Scene by scene

1. 
   13:47

   One story: the join across four systems; one case

   The graph has joined what no single system holds. Outside: two listings, one seller. Authentication: sessions on stolen passwords. Core banking: payments from those sessions. Onboarding: the receiving accounts, opened on identity documents bought from the same market. Four systems and two feeds. One case — not nine, not fourteen, not thirty-eight.

2. 
   14:20

   The delivery chain: text, domain, app, telemetry

   How did the fake app get onto their phones? A text, a lookalike domain, and a sideloaded app called Aurum Capital — reported by the security component inside the bank's own mobile app. The bank's own telemetry, read in place, turns 'a customer was scammed' into 'a customer installed this app from this domain'. And that domain sits on the same network block as the login wave.

3. 
   14:50

   Ruth's checklist; the stale feed declared

   Ruth, head of operations, opens her day.

4. 
   14:55

   While it works

   Each answer points back to the records it came from.

5. 
   15:01

   Ruth Adler signs in

   Now Ruth Adler, the head of operations, signs in to start the morning.

6. 
   15:10

   Ruth Adler lands

   Ruth's start page is her own: the queue, the deadlines, and what is addressed to her.

7. 
   15:18

   An alert in the bell

   Ruth has an alert waiting in the bell.

8. 
   15:28

   A stale source is declared, never silent

   Her checklist isn't written by anyone; it's answered from the data. One line says the consortium feed has been stale. That warning is written on every case it touches until the feed returns. A stale source is declared, never silent.

9. 
   15:50

   Priya Nair signs in

   Now Priya Nair, a fraud analyst, signs in. Priya reaches out to the customers who were hit.

10. 
    16:00

    Priya Nair lands

    Priya lands on her own start page — only what her role and her cases allow her to see.

11. 
    16:08

    An alert in the bell

    Priya has an alert waiting in the bell.

12. 
    16:16

    Who to call first

    Priya, in fraud, asks the Dialog who to call first.

13. 
    16:22

    Every customer at once

    It checks every customer at once: on both lists, and taken over from a new device.

14. 
    16:31

    While it works

    It shows every step it takes, so every number can be checked.

15. 
    16:40

    Dialog: the three priority victims highlighted

    Three of them. Lena Voss is one — and she's still paying.

16. 
    16:51

    Case raised by triage

    The case already exists: the triage agency opened it and assigned it to Priya.

17. 
    16:59

    Priya adds subjects through the Dialog

    She asks the Dialog to add the seller and the Lisbon desk as targets, and Lena as a victim.

18. 
    17:08

    Her actions, her permissions, the audit trail

    It uses the same actions she would click, under her permissions, and every step goes in the audit trail.

19. 
    17:19

    The working theories, on the timeline

    Then she writes her working theories on the timeline — one seller running it all, a seller supplying a separate ring, or a leak from inside.

The money is followed to the Lisbon desk, and the freeze goes through two people. The same customer is read two ways by two teams from one graph. The reach-out agency stops a £60,000 payment. And the graph itself is shown to be access-controlled.

Features shown

Scene by scene

1. 
   17:34

   Rails to chains; observed and derived edges

   Follow the money. The fourteen mule accounts forward ninety-eight per cent within forty minutes to an OTC desk in Lisbon, which buys stablecoins on Tron, into a cluster of forty-one wallets across three chains.

2. 
   17:55

   While it works

   What it finds is written as your policy allows: applied where it may, proposed where you reserve it.

3. 
   18:04

   While it works

   Every answer is drawn from the graph the bank's own sources built.

4. 
   18:11

   Observed edges · derived edges, and the policy

   Watch the lines. Observed edges show what happened. Derived edges show what a policy concluded, and name the policy. They're never drawn the same way.

5. 
   18:28

   While it works

   It works with the same permissions as the person asking.

6. 
   18:35

   Assignment on the case

   The decision to freeze isn't the agencies' to make. It belongs to Priya, our fraud analyst, and it reaches her the way the team works: as an assignment on the case, with the proposal already drafted.

7. 
   18:51

   No phone call, no link

   No phone call, no link. It's waiting in her notifications.

8. 
   19:01

   Priya signs in as herself

   Priya signs in as herself and sees what her role allows.

9. 
   19:07

   The fraud gate: 14 frozen · 0 victim accounts frozen

   She freezes outbound payments on the fourteen mule accounts and holds the Lisbon desk — and does not freeze the victims.

10. 
    19:17

    Compromise, not complicity

    Compromise, not complicity. She writes exactly why.

11. 
    19:26

    The approve control is not theirs

    The agencies drafted all of it; the approve control simply isn't available to them.

12. 
    19:35

    Two-person approval

    And she can't approve her own request.

13. 
    19:39

    Marcus's approval: the second person

    It goes to a second person: Marcus, our MLRO.

14. 
    19:45

    Marcus Feld signs in

    Now Marcus Feld, the MLRO, signs in. Marcus decides what the bank reports to the authorities.

15. 
    19:56

    Marcus Feld lands

    Marcus sees the same platform from a different desk: what is waiting for his decision.

16. 
    20:04

    An alert in the bell

    Nobody here goes looking for work. It arrives in the bell, at the top right.

17. 
    20:13

    What the alert says

    The alert says what is waiting, and on which case.

18. 
    20:18

    Straight to the case

    One click, and you are on the case.

19. 
    20:23

    Approved under his name

    He reads her reasoning and approves under his name.

20. 
    20:28

    Two people, two names, one audit trail

    Two people, two names, one audit trail.

21. 
    20:37

    Two contexts: the same customer, side by side

    Ade opens the same customer, eight minutes after Priya.

22. 
    20:43

    Ade Balogun signs in

    Now Ade Balogun from security operations signs in. Ade decides on the security actions the agencies propose: approve them, or decline them with a reason.

23. 
    20:59

    Ade Balogun lands

    Ade lands on a start page that holds only what security owns today.

24. 
    21:06

    An alert in the bell

    Ade has an alert waiting in the bell.

25. 
    21:16

    The same customer

    Ade opens the same customer, Lena Voss.

26. 
    21:21

    One graph, two meanings

    Same twelve facts, same citations, nothing withheld from either. To Priya, Lena is a victim with money to recover. To Ade, she's an exposed password, a hijacked session and an attack technique. The same payment is 'funds to recover' in one context and 'impact of the compromise' in the other. One graph, two meanings — and that's why the two teams stop fighting over one screen.

27. 
    21:55

    The call: £312,000 on screen · £60,000 about to go · £0 sent

    If you remember one moment today, make it this one. Lena has three hundred and twelve thousand pounds on a trading screen that isn't real, and she's about to send sixty thousand to unlock it. The reach-out agency calls her on the channel she trusts, with a script written for exactly this kind of coercion. She stops. The sixty thousand never leaves.

28. 
    22:26

    Outcome recorded

    Recorded on the case: vulnerability flagged, recalls on the two earlier payments, her device reset and her password rotated.

29. 
    22:41

    The graph is access-controlled

    This graph holds customers, victims and suspects, so it is not open to the whole bank. The workspace is restricted to the people working the case.

30. 
    22:54

    Sam Okoro signs in

    Now Sam Okoro, an analyst on the lending team, signs in. Sam works at the same bank, but is not on this case, and not a member of this workspace.

31. 
    23:08

    Sam Okoro lands

    Sam lands on the same home page as everyone else at the bank, with a different set of keys.

32. 
    23:17

    No access for Sam

    Sam is not a member, so on Sam's home page the workspace shows as locked, marked no access. Sam can see that it exists, and nothing inside it.

33. 
    23:32

    What Sam is told

    Sam is told why, and who to ask. Sam can see which investigations it holds, and nothing else.

34. 
    23:45

    The shape, not the content

    Sam can open the Operation Mirage graph, but only its shape: how many entities of which type, and how they connect. Every name and every detail is withheld. They are never even sent to Sam's browser.

35. 
    24:04

    Every node withheld

    Select any node, and it reads: restricted, withheld. Nothing can be searched, expanded, exported, or asked of the Dialog. To see more, Sam has to ask for access, and the owners decide.

36. 
    24:25

    Ade Balogun signs in

    Ade Balogun signs back in.

37. 
    24:30

    Ade Balogun lands

    Ade is back on the start page, where the next thing is already waiting.

The investigation goes after the infrastructure and the money that can still be reached. Every hop is graded, attribution meets its threshold, requests go out from the case and replies come back as evidence.

Features shown

Scene by scene

1. 
   24:40

   The infrastructure hunt; the certificate pivot

   The fake app calls home. The utility walks from the app to its certificate, to three domains sharing it, to two hosts — and lands on the same network block as the login wave and the phishing text. Three techniques, one infrastructure, every hop graded.

2. 
   25:01

   Takedown approved; evidence pack released

   Ade approves the takedown and a sinkhole. The hosting provider wants evidence before it acts; the agencies have already drafted the pack, and Ade releases it. The app on nineteen phones has nowhere to call.

3. 
   25:20

   An alert in the bell

   Another alert for Ade, and Ade follows it straight to the case.

4. 
   25:33

   Bridge observed; mixer output derived at 0.71

   The ring moves its money through a bridge, then a mixer. Through the bridge we still hold the trail. Through the mixer the addresses break, and the utility shows the pattern at 0.71 — marked as derived, with the policy that produced it — and never rounds it up to a fact.

5. 
   26:00

   Two sources, two grades: confirmed

   A leak on Telegram names the Lisbon desk. On its own that's a rumour, and it's graded as one. Then the consortium list, which has never seen the leak, confirms the addresses independently. Credible becomes confirmed.

6. 
   26:19

   The identity documents share one template

   And the identity documents behind the mule accounts, read where they sit, turn out to share one template.

7. 
   26:31

   Four vertices, four sources, two prior rings

   Attribution. It takes four independent sources — the infrastructure, the app, the victims, the seller. And one of them is memory. The app's build hash was already in the graph, from two rings last year. Nobody had to remember. The estate did.

8. 
   26:57

   While it works

   Each answer points back to the records it came from.

9. 
   27:04

   Requests to two exchanges

   Marcus goes after the money that can still be reached: six hundred and ten thousand at two exchanges.

10. 
    27:14

    Marcus Feld signs in

    Marcus Feld signs back in.

11. 
    27:22

    Marcus Feld lands

    Marcus is back in, and the platform picks up where the case is now.

12. 
    27:29

    An alert in the bell

    The bell again: Marcus opens it, and is on the case in one click.

13. 
    27:39

    The request goes out from the case

    The request for information goes out from the case.

14. 
    27:48

    Replies land on the case, fingerprinted

    The exchange can simply reply by email; the reply and its attachments land on the case as evidence, fingerprinted.

15. 
    27:58

    380,000 frozen

    One exchange freezes three hundred and eighty thousand within the hour.

16. 
    28:06

    A step with an owner and a clock

    The other wants a court order — recorded as a step with an owner and a clock, not as a loss.

17. 
    28:17

    The honest halt: inferred beyond it — nothing

    The rest enters a shielded pool and the chain goes dark. The utility writes it down — one point seven nine million in, resolution stops — and it does not guess what came out.

18. 
    28:34

    The honest halt: inferred beyond it — nothing

    That's the moment a regulator trusts you for.

What keeps it defensible. Deconfliction across the information barrier, incidents raised by the platform itself, a suspicious activity report on a restricted route, quality challenging the day, and the knowledge the bank keeps.

Features shown

Scene by scene

1. 
   28:43

   The notice across the wall

   The afternoon is governance. The Lisbon desk turns up in a trade-finance case on another desk. The notice that crosses the wall names the entity, and nothing else.

2. 
   28:58

   An alert in the bell

   Nobody here goes looking for work. It arrives in the bell, at the top right.

3. 
   29:07

   What the alert says

   The alert says what is waiting, and on which case.

4. 
   29:13

   Straight to the case

   One click, and you are on the case.

5. 
   29:17

   The incident, open

   Nine thousand four hundred pounds left one mule account three minutes before the freeze. The utility raises the incident itself — and Priya's closed case does not close it.

6. 
   29:33

   An alert in the bell

   Another alert for Marcus, and Marcus follows it straight to the case.

7. 
   29:41

   A SAR on a restricted route

   Marcus considers a suspicious activity report on a restricted route.

8. 
   29:48

   An alert in the bell

   The bell again: Marcus opens it, and is on the case in one click.

9. 
   30:00

   Priya Nair signs in

   Now Priya Nair, a fraud analyst, signs in. Priya reaches out to the customers who were hit.

10. 
    30:10

    Priya Nair lands

    Priya lands on her own start page — only what her role and her cases allow her to see.

11. 
    30:18

    An alert in the bell

    Priya has an alert waiting in the bell.

12. 
    30:28

    Second line

    Back on her case, Priya opens Second line.

13. 
    30:34

    Priya sees: with second line

    Priya sees three words: 'with second line'.

14. 
    30:39

    Marcus Feld signs in

    Now Marcus Feld, the MLRO, signs in. Marcus decides what the bank reports to the authorities.

15. 
    30:51

    Marcus Feld lands

    Marcus sees the same platform from a different desk: what is waiting for his decision.

16. 
    30:59

    Tuning replayed against fourteen months

    Quality challenges the best moment of the day, the phone call, and confirms it followed the approved script. It proposes one tuning — replayed against fourteen months of history before it can go live.

17. 
    31:16

    An alert in the bell

    Another alert for Marcus, and Marcus follows it straight to the case.

18. 
    31:30

    The replay

    It runs now, against the bank's own history.

19. 
    31:35

    Three pieces of new knowledge, approved

    And what the agencies learned today — the seller, the build hash, the document template — is approved into the graph and versioned. Self-enriching under governance; never self-learning without supervision. The next ring is found faster.

20. 
    31:56

    An alert in the bell

    The bell again: Marcus opens it, and is on the case in one click.

21. 
    32:05

    Everything the team needs lives on the case

    Everything the team needs lives on the case: tasks with owners, one calendar for every deadline, reports, whiteboards, the workflow with timers that escalate when a step stalls, access control, and an audit trail that no one can quietly rewrite.

The day in numbers, the whole machine on one screen, and what it rests on.

Features shown

Scene by scene

1. 
   32:25

   The day as numbers

   Thirty-eight exposed, two hundred and twelve targeted, one case. Sixty thousand pounds that never left. Three hundred and eighty thousand frozen. One point seven nine million that stops at a shielded pool — and says so. Three things the bank now knows that it didn't know this morning. And not one raw record out of the boundary.

2. 
   32:58

   The whole machine: two utilities, one graph

   This wasn't a second product. The financial-crime utility and this one run on the same graph — the same customers, the same people at the gates. Cyber took four entity types and five new agencies, composed by the bank itself. The next utility inherits both.

3. 
   33:22

   Read in place · composed by your people · inside your boundary · owned by you

   That's the difference. Other programmes build a world the bank moves into: their model, their engineers, quarters to deploy, years of dependency. AIState is the bank's own estate, read where it lives, run by agencies its own people compose, inside its own boundary. A lower cost to own, value in weeks, no standing team of vendor engineers — and a knowledge asset that belongs to the bank.

4. 
   33:55

   Thank you

   One day. Same estate. Two departments, one graph. Thank you — I'd be glad to take your questions.

The core of AIState, in detail: how the bank’s data is organised without copying it. Every source connected with its own access control, lineage across the systems, a dashboard for every source, the schema and the ontologies, governance and observability — then the graph: the full estate on one canvas, its geography, and the investigation built from the sources.

Features shown

Scene by scene

1. 
   34:12

   The Knowledge Fabric, and its estate

   Now I'm going to show you the Knowledge Fabric, and its estate: how our data is organised, without copying it.

2. 
   34:22

   The core of the platform

   The Knowledge Fabric is the core of AIState. It connects every data source the bank has, keeps each source's own access control, and builds one knowledge graph without copying the data.

3. 
   34:38

   One live state, across every system

   It draws the lineage across those sources, so you see live data relating across different systems, as one full state of the estate. Here are thirty-six of its features, and then the graph.

4. 
   34:55

   Every source in one place

   The Fabric's home lists every system it reads: ten of the bank's own, and seven outside sources.

5. 
   35:05

   Read in place — nothing copied

   Each system is read where it lives. No rows are copied into the platform: the system of record stays authoritative.

6. 
   35:17

   Live status for every source

   Every source shows its live status: connected, degraded or offline, checked against the system itself.

7. 
   35:28

   Estate statistics

   Estate statistics count what the fabric knows: entities, relationships, records, cases and evidence, across the whole estate.

8. 
   35:40

   Infrastructure performance

   Infrastructure performance is real telemetry, not a mock-up: load, memory and requests per hour on every service the fabric runs on.

9. 
   35:52

   The estate over time

   Data assets by kind over time, and how much of the estate is described and owned, day by day.

10. 
    36:02

    A dashboard for every source

    Every source has its own dashboard. This is authentication: every login attempt, with its address and device.

11. 
    36:13

    Records, tables and freshness

    The overview shows how many records it holds, its tables, the records arriving per day, and when it was last read.

12. 
    36:25

    Columns, profiled automatically

    Its columns are found automatically, and each is profiled: how complete it is, and how many distinct values it holds.

13. 
    36:36

    Data quality in six dimensions

    Data quality is scored in six dimensions: completeness, uniqueness, accuracy, consistency, validity and timeliness.

14. 
    36:48

    Connectivity, probed every 15 minutes

    Every source is probed every fifteen minutes and each probe is recorded, so an outage shows up the hour it happens.

15. 
    36:59

    Read by

    Read by shows who and what reads this source: which agencies, which workspaces, how often.

16. 
    37:08

    Access control is kept

    The source's access-control list travels with it: who may read it, query it or administer it, and on what basis.

17. 
    37:19

    Its Source State Graph

    And its Source State Graph: the same graph as the estate, drawn for this one source — the people and the addresses it linked, across every investigation built from it.

18. 
    37:33

    Drill into a table

    You can drill down from a system to one table. Here is the login attempts table, with a dashboard of its own.

19. 
    37:44

    Sample data, read live

    And a sample of its rows, read straight from the source as you open it. Nothing is stored.

20. 
    37:54

    The bank's own systems

    Each of the ten internal systems has the same dashboard: core banking, payments, cards, onboarding, the customer master and the rest.

21. No screenshot
    38:05

    Core Banking — source dashboard

    Core banking: accounts and onward transfers.

22. 
    38:12

    Payments — source dashboard

    Payments: every payment, with the session it came from.

23. No screenshot
    38:20

    Cards — source dashboard

    Cards: card accounts.

24. No screenshot
    38:26

    Authentication — source dashboard

    Authentication: every login attempt, with address and device.

25. No screenshot
    38:36

    Onboarding — source dashboard

    Onboarding: accounts opened and the device behind each.

26. No screenshot
    38:44

    Document Store — source dashboard

    Document store: the identity documents behind each account.

27. No screenshot
    38:52

    Customer Master — source dashboard

    Customer master: every customer the bank holds.

28. No screenshot
    39:00

    Mobile App Telemetry — source dashboard

    Mobile app telemetry: the security component in the bank's own app.

29. No screenshot
    39:09

    Contact Centre — source dashboard

    Contact centre: calls and reach-outs to customers.

30. 
    39:17

    Security Operations — source dashboard

    Security operations: what was pushed to the perimeter.

31. 
    39:24

    Outside sources, graded

    And so do the seven outside sources, chain analytics, threat intelligence, passive DNS and the darknet monitor among them, each graded for reliability and credibility.

32. 
    39:38

    Chain Analytics — source dashboard

    Chain analytics: addresses, clusters and the money trail.

33. 
    39:46

    Threat Intel — source dashboard

    Threat intelligence: infrastructure, networks and techniques.

34. 
    39:54

    Passive DNS — source dashboard

    Passive DNS: what the domains resolved to, and their certificates.

35. 
    40:03

    Registrar Abuse API — source dashboard

    Registrar abuse desk: registrations and takedowns.

36. 
    40:12

    Telegram Monitor — source dashboard

    Telegram monitoring: leaks naming the bank or its counterparties.

37. 
    40:21

    VASP Consortium — source dashboard

    VASP consortium list: addresses flagged by member exchanges.

38. 
    40:30

    Darknet Monitor — source dashboard

    Darknet monitoring: listings for the bank's domain.

39. 
    40:35

    Explore the catalogue

    Explore is the catalogue: every asset the fabric discovered, searchable, with its owner, tier and tags.

40. 
    40:45

    Lineage across the sources

    Lineage draws how data travels between the sources, upstream and down, across every system.

41. 
    40:54

    Live relations, across systems

    So the same customer can be followed from the login, to the payment, to the wallet: live relations across different systems, as one state.

42. 
    41:06

    The schema, as it really is

    The schema is the data model as it really is in the graph: every entity type, how many exist, and their fields.

43. 
    41:17

    A type, field by field

    Open a type and its fields are drawn as a graph, generated from the data and still editable.

44. 
    41:26

    The schema graph

    And the schema graph shows how the types connect to each other, drawn from the graph itself.

45. 
    41:35

    Ontologies

    Ontologies are the vocabulary the platform speaks: the bank's own models, versioned, drafted and published.

46. 
    41:46

    An ontology, discovered

    This one the discovery process built from the bank's systems: every concept it found, and how the schemas under them link.

47. 
    41:56

    Every schema it found

    On the right, every schema the system identified. Open one to see its fields, its code, and its graph.

48. 
    42:07

    The model, drawn

    A published model is drawn as a graph of its classes and the relations between them.

49. 
    42:16

    Contexts

    Contexts give each team its own view of the same entities: fraud sees one thing, security another, from the one graph.

50. 
    42:27

    MCP connectors and the built-in hub

    Connectors reach outside tools over MCP, and the built-in hub brings over a hundred investigation tools, each read-only and audited.

51. 
    42:40

    Data quality tests

    Data quality tests run on every sync, by test case and by suite.

52. 
    42:48

    Incident manager

    A failing test becomes an incident, with a status, a severity and an assignee.

53. 
    42:56

    Alerts

    Alerts send those incidents to a webhook or an inbox, the moment they happen.

54. 
    43:04

    Insights

    Insights shows how the estate is used, and how healthy it is.

55. 
    43:12

    Domains

    Domains group the estate the way the bank is organised, each with an owner.

56. 
    43:19

    Glossary and classifications

    The glossary holds the bank's own terms, defined once, and classifications mark what is personal, sensitive or restricted.

57. 
    43:32

    The full estate graph

    On the left, the estate graph: every entity and relationship across the investigations you can see, on one canvas. This is the full state.

58. 
    43:45

    Draw more of it

    Draw as much of it as you need: the budget is shared fairly between the investigations, so no single one fills the map.

59. 
    43:59

    Geographical distribution, in real time

    You can also see the geographical distribution: everything with a location is placed on the map, indexed in real time as the sources change.

60. 
    44:12

    A graph built from the sources

    Operation Mirage was built from ten of the connected tables. Each was read where it lives: the graph knows where every entity came from.

61. 
    44:27

    Clusters

    Clusters find the communities in the graph by themselves.

62. 
    44:35

    Centrality analysis

    Analysis ranks every node: degree, betweenness, page rank, closeness and communities. Here, the bridges between the groups.

63. 
    44:49

    Search and focus

    Search finds any entity by name or identifier, frames it on the canvas and opens its connections.

64. 
    45:01

    Three dimensions

    The same graph in three dimensions, for structure that a flat drawing hides.

65. 
    45:09

    Rankings

    Rankings list the most central entities, so the ones that hold the network together are found first.

66. 
    45:19

    Lens and bundling

    A fisheye lens to read a dense corner, and edge bundling to see the main flows.

67. 
    45:27

    Lasso

    And lasso a group of entities, to work on them together.

68. 
    45:34

    Connect. Resolve. Read in place.

    That is the Knowledge Fabric: every source connected and governed where it lives, one graph across all of them, and the full state of the estate in one place.