AIYour assistant
How it works
A plain guide to every page. If you are new, read Start here first.
The idea in one minute
Your security tools each see part of your devices. Nobody sees all of them. The devices nobody sees are the ones that get you into trouble.
DARKMAP compares what your different sources saw. If two sources mostly saw the same devices, you are probably seeing nearly everything. If they mostly saw different devices, there are many more that both missed. From that it works out a number: at least this many devices are missing.
Then it helps you shrink the number: it asks the right person to go and look, lets them report from a phone with no setup, accepts reports carried on a USB stick from networks with no internet, and refuses to run safety checks until you know a network well enough.
On top of that sits the security lead's layer. Risks, rules, incidents, people and vendors all live in the same records, and every one of their numbers is held down by the same fact: nothing can be more certain than the share of devices you actually know.
The AI is on every page
The AI badge marks everything the model does. At the top of each page it tells you what you are looking at and what to do next. Inside the pages it can: guess what a scanned device is, propose risks for a network, turn a one-line description into a classified incident with containment steps, suggest who should own a device, explain why a rule or a safety check is not OK, and write the paragraph for management.
Model: DeepSeek V4 Flash through nano-gpt. Every suggestion is labelled. Nothing the model says becomes a record until you press yes. If the model cannot be reached, the app shows computed facts instead and says so.
Each page and what to do on it
| page | what it shows | what you do |
|---|---|---|
| Missing devices | The home page. One big number: how many devices you are probably not seeing. It is a floor, so the truth can only be higher. | Press "Load example company" once to see it filled in. The table shows each network, how many devices you know, how many are probably missing, and whether the estimate is solid or rough. |
| Answer questions | The app looks at its own gaps and asks you yes/no questions, starting from the big picture (are there machines with controllers? cameras?) and narrowing to the kind, the maker and the product; then which well-known products are probably in the unknown part of a network, whether a device only one tool saw is real, who owns a device, whether a rule holds. You never type. | Press yes, no or not sure. Each yes becomes a record with the details filled in by the app (maker, protocols, what needs protecting). Keep going until each network shows "gap explained". |
| Map | A picture of each network. Grey dots are devices you know. Diamonds are your sources. The dashed black circle is everything nobody has seen. | Tap a dashed circle and press "Ask someone to check". The app picks the person who already works there and adds a task to the To-do list. |
| Report a device | A page for anyone with a phone. No app to install. It works with no internet: reports wait on the phone and send later. | Scan the sticker or type the label, say which area you are in, answer one question, press Save, then Send. In a place with no internet at all, press "Save as file" and carry the file out on a USB stick. |
| Bring a file | Where you load the file a technician carried out on a USB stick. | Choose the file. The app checks it was not changed on the way, then adds the reports. |
| To-do list | Tasks for people. "Go and look" tasks go to whoever works in that area. "Please confirm" tasks go to someone who wrote a support ticket about a device nobody else has seen. | Paste helpdesk ticket text at the bottom: the app finds device names and addresses inside it. A task closes by itself when someone reports a device in that area. |
| Safety checks | Defensive actions from the MITRE D3FEND standard. The app refuses to run them on a network you barely know and says exactly what is missing. | Pick a network. Press "See details" to read what each check needs. Press "Create tasks" to turn the ready checks into tasks on the To-do list. |
| All records | Every sighting ever recorded, never edited or deleted. The place to answer "where did this fact come from?" | Read only. Newest first. |
| Team lead | One screen for the person running security: how safe you are (a number that can never be higher than the share of devices you know), what to do next, who carries the unknown, and a report you can paste to management. | Read it every morning. Work the list top-down: it is ranked by how unknown the network is times how bad the item could be. |
| What could go wrong | Your list of risks. Each network's unknown devices are a risk on their own, added automatically with an owner. A risk scores higher in a network you barely know. | Set the line you accept. Anything above it gets a task for someone. Add your own risks; give them an owner and a plan. |
| Rules we follow | The rules from the NIST and ISO standards, each checked against your records instead of a checkbox. A rule can never score above what you know. Every check is a proof record that cannot be changed later. A rule that was OK and then the network got darker is marked "slipped". | Pick a network and read the status column. For rules that need a person (policy, training) type your name and press "I confirm this". |
| Things that happened | Security incidents. You cannot close one while a network it touched is mostly unknown. Closing writes what you learned into the records. The same kind of incident in the same network reopens its risk by itself. | Report, mark contained, then close with one line on what you learned. |
| Who owns what | People and vendors. Every device should have an owner. When someone leaves, their devices become "no owner" and a task is created. Vendors are rated no higher than how well you know the networks they touch. | Add people, give devices owners, press "This person left" when they do. Add vendors and attribute their devices. |
Questions admins ask
Why does the number sometimes go UP after someone reports devices?
Because they found devices nobody had seen. That is real information: your estimate of how much is hidden gets more honest. The number goes DOWN when a person confirms devices that only one tool had seen, because that proves your tools are closer to complete.
What does "solid" or "rough" mean?
Solid: at least two sources agree on some devices, so the estimate can be trusted. Rough: your sources never agreed on a single device, so add another source (a scan, a phone report) before trusting the number.
Can someone fake a phone report?
No. Every report is stamped by the phone that made it. If a file is changed on the way, the app rejects it and says so on the All records page.
Why won't it run a safety check?
Two reasons: too many missing devices in that network, or the check needs information (like what software runs on the devices) that no source has given yet. The page names what is missing.
Why can the safety number never go above the known share?
Because a rule can only be checked on devices you can see. If 60% of your devices are known, the best you can honestly say is 60% safe. The rest is unknown, not safe. The number rises when people report devices, not when someone ticks a box.
What does "slipped" mean on a rule?
The rule was OK when the network was well known. Since then the network got darker (new devices only one source saw). The rule is not trusted any more until the network is known again. A task is sent to whoever works there.
Why can't I close an incident?
One of the networks it touched has too many unknown devices. "Contained" over devices nobody has seen is a guess. Ask someone to walk that area and report devices; then close.
How do I connect my real tools?
Any tool can send sightings to the app with one web request. Ask whoever runs your security tools to post to /api/sightings; the format is in the README of the project.
Words used in the app
| Network | A group of devices, like the office, the cloud, or a factory floor. |
| Source | Anything that can see devices: a security tool, a network scan, support tickets, a person with a phone, a USB file. |
| Sighting | One source seeing one device once. |
| Missing devices | Devices that exist but no source has seen. Shown as "at least X%". |
| Task | A request for a person to go and look or to confirm something. |
| Safety check | A defensive action from the MITRE D3FEND standard. |