Stories & analysis
Human-readable interpretation connected to the evidence in H3XA. These narratives explain why patterns matter, what remains uncertain, and where to inspect the underlying data.
Reading cross-domain convergence
How to distinguish coincident observations from a pattern that deserves deeper investigation across cyber and air domains.
Research briefWhat deserves attention in a live picture
A practical framework for moving from a high-volume feed to an evidence-backed analytical priority.
ExplainerReading internet disruptions as geopolitical signal
Why deliberate network shutdowns and connectivity collapses are observable evidence of state action, and how to separate an outage from a shutdown.
ExplainerThe AI/ML threat landscape in H3XA
How adversarial machine-learning techniques map to the MITRE ATLAS framework, and why AI systems need their own threat taxonomy.
Trend analysisExploited vulnerabilities are the signal
CISA's Known Exploited Vulnerabilities catalog separates the vulnerabilities attackers actually use from the long tail of theoretical CVEs.
Regional analysisWhere connectivity is being withheld
Internet shutdowns cluster geographically. Understanding the regional pattern explains why a shutdown happens and what it signals.
TimelineAnatomy of a shutdown
A representative timeline of how a deliberate internet restriction unfolds, from pre-event baseline to restoration.
Research briefHow to read a threat-intelligence graph
STIX objects and relationships are the backbone of H3XA's cyber layer. Here is what they mean and how to move through them.