Whitepaper32 pages
Airspace Awareness from Open Data
ADS-B, Mode-S and GNSS interference: what open aviation data can reveal, its limits, and how to fuse it responsibly.
Read[DI]//Kimo Defense Intelligence
Signal, not noise.Fused, scored, sovereign.
Kimo correlates OSINT, SIEM and sensor feeds into scored incidents your analysts can act on in minutes, deployed in your cloud, your data center or a fully air-gapped enclave.
- 01 Deploy
- Cloud · On-prem · Air-gap
- 02 Access
- ABAC · Need-to-know
- 03 Audit
- Hash-chained, append-only
Fusion // sector N-4
CyberMaritimeAirOSINT
09:41:12Z23 aircraft report GNSS degradation in sector N-4
09:40:35ZCorrelated: VPN brute force + new admin account
09:39:58ZVessel IMO 9xxxx41 stopped transmitting for 47 min
Fuses 46 feeds, incl.
- Splunk
- Elastic Security
- Apache Kafka
- AIS Maritime
- ADS-B Air Traffic
- OSINT Feeds
- Telegram Channels
- OpenStreetMap
- EDR Telemetry
- Datadog
- GitHub
- PostgreSQL
[01]//Situation room
The live picture. Switch theatres, filter feeds, open an incident.
This is the actual product running on simulated feeds. Every marker is a scored incident with its evidence one click away.
Interactive
KIMO // SITUATION ROOM 18/18 FEEDS09:41:12Z
BALTIC & NORTH SEA · 50.0°N 4.0°W → 66.0°N 32.0°E
7 INCIDENTS
AIS track ADS-B track
INC-4833MaritimeCritical
Anchor-drag signature over data cable
Baltic & North Sea · 59.9°N 22.1°E · first seen 44 min ago · 12 correlated events
Sources
Confidence93%
Events · 24h
1,284,310
Correlated · 24h
37
Feeds online
18 / 18 Healthy
Mean time to correlate
4.2 min
EVENT STREAM
AIS Maritime09:40:35Z
Vessel IMO 9xxxx41 stopped transmitting for 47 min
HighBaltic & North Sea
Splunk09:39:58Z
Correlated: VPN brute force + new admin account
CriticalBaltic & North Sea
ADS-B Air Traffic09:39:21Z
23 aircraft report GNSS degradation in sector N-4
MediumBaltic & North Sea
Telegram Channels09:38:44Z
Narrative "port strike" up 4.2x on monitored channels
LowEastern Mediterranean
Elastic Security09:38:07Z
Detection T1566 phishing — 9 mailboxes, 2 clicks
MediumEastern Mediterranean
[AIR]//Airspace awareness
The air picture, from open data. ADS-B in, anomalies out.
Aircraft broadcast who they are, where they are and how sure they are of it. Kimo turns those public signals into tracks, squawk alerts and a live map of GNSS interference, for civil air-safety teams and researchers.
Airspace · North Sea / Baltic09:10:00Z
Tracks
37
Squawk alerts
0
GNSS area
189k km²
Feed
Simulated
All aircraft, identifiers and interference values are simulated.
01
ADS-B + MLAT fusion
Positions aircraft broadcast themselves, completed by multilateration for those that only reply to interrogations. One de-duplicated track per ICAO address.
Tracks · trails · 6 h replay
02
GNSS interference mapping
Aircraft report how much they trust their own position (NIC / NACp). Kimo bins those reports into hexes and maps where integrity drops, without guessing at causes.
Hex share of NIC < 7
03
Squawk & anomaly alerting
Emergency (7700) and radio-failure (7600) codes, unusual descents, loitering patterns and zone entries, each scored with a confidence and the evidence attached.
7700 · 7600 · descent · zone
[02]//How it works
From raw feeds to a briefed decision. Four steps, all audited.
01
Ingest
Connect feeds
SIEM detections, sensor topics and open sources stream into one normalized event store.
1.28M events / day
02
Correlate
Resolve & fuse
Entities are resolved across sources; correlation rules group evidence into candidate incidents.
18 sources resolved
03
Score
Score & route
Each incident gets a transparent confidence score and lands in the right cell’s queue.
37 incidents scored
04
Brief
Decide & brief
Analysts confirm, annotate and publish a marked brief. Every step is in the audit trail.
4.2 min to correlate
[03]//Capabilities
Built for the watch floor. Not adapted from a sales dashboard.
Alert noise
-0%
reaching analysts after correlation (national CERT)
Dark-vessel flag
0 min
median time from AIS gap to scored incident (maritime authority)
Mean time to correlate
0.0 min
from first raw event to a fused incident
Network egress
0 bytes
in air-gapped mode. No telemetry, no call-home.
Anonymized customer stories · figures illustrative
[04]//Sovereign by design
Runs where your data must stay. Even with the cable unplugged.
The same product in a sovereign cloud, your data center or a classified enclave. Every view, query and export lands in a hash-chained audit trail.
Sovereign cloud
Managed by us, hosted in-country.- Dedicated single-tenant cluster
- EU-sovereign hosting, local operators
- Customer-managed encryption keys
- Live in under two weeks
On-premise
Your data center, your rules.- Kubernetes or bare-metal installer
- Integrates with your IdP, HSM and SIEM
- Horizontal scaling to billions of events
- Optional on-site support engineers
Air-gapped
Zero network egress. Ever.- Offline installer and signed update bundles
- Local language models on your GPUs
- No telemetry, no licence call-home
- Designed for classified enclaves
Audit // append-onlychain ok
TimeActorObjectResultChain
09:45:18Zanalyst.k.rao EXPORTtrack/T1.geojsondeny881b93→871b92
09:44:37Zanalyst.t.berg ANNOTATEincident/INC-4844allow891b95→881b93
09:43:56Zadmin.s.novak ROLE_CHANGEuser/analyst.t.bergallow8a1b97→891b95
09:43:15Zcontractor.p.lee VIEWcompartment/HUMINT-REFdeny8b1b98→8a1b97
09:42:34Zanalyst.j.ortega QUERYmodel/cyber-socallow8c1b9a→8b1b98
09:41:53Zlead.m.dubois EXPORTbrief/BALTIC-2026-10-10.pdfallow8d1b9b→8c1b9a
chain verified · forwarding CEF → SIEM
ABACNeed-to-know enforced at query time
HSMKeys in your HSM, rotate any time
[05]//In service
Trusted where the stakes are real. Four teams, four theatres.
We used to stitch AIS exports and analyst notes together by hand. Now the gap is flagged, scored and on the watch lead’s screen before the vessel leaves the zone.
Head of Maritime Operations Center
Maritime operations · Coastal maritime authority · North Sea
[06]//Missions
One platform, every cell. From the SOC to the ministry.
[07]//Integrations
Your sensors. Your SIEM. Open sources.
Native connectors for the security stack and the sensor world, plus any Kafka topic or PostgreSQL database. Credentials stay in your vault.
[08]//Editions
Priced by deployment, not by seat count games. Three editions.
Dedicated EU tenant
Most deployedSovereign Cloud
One cell, live in two weeks.
$5,750per month · up to 25 analysts
- Dedicated single-tenant cluster, EU-hosted
- 25 connectors incl. SIEM, AIS, ADS-B, OSINT
- Correlation rules & scored incidents
- Ask Kimo with source citations
Your Kubernetes
On-prem
Your data center, your keys.
$14,500per month · up to 100 analysts
- Kubernetes or bare-metal installer
- All connectors + custom Kafka topics
- ABAC, compartments & classification labels
- HSM-held keys, SIEM-forwarded audit
Disconnected enclave
Air-gapped
Zero egress. Ever.
Custommulti-site · cleared support
- Offline installer, signed update bundles
- Local language models on your GPUs
- Cross-domain import via data diode
- On-site engineers, accreditation pack
Every edition includes the full feature set for its deployment. See what’s in each
Mission resources
Open data, rigorous methods
Research-grade guides on ADS-B ingestion, airspace alerting and GNSS-interference mapping from public aircraft reports.
[09]//FAQ
Questions from accreditors.
And from the analysts who will use it every shift.
Yes. The Air-gapped edition ships as an offline installer with signed update bundles. Language models run locally on your GPUs, and nothing ever calls home: no telemetry, no licence checks, no external APIs.
[END]//Next step
Put Kimo on watch. Your feeds, your enclave, your keys.
See your own sources fused into scored incidents in a 45-minute working session, or open the live demo now. All demo data is simulated.
