RPostAI Labs

01

LAB 01Active research

RAPTOR Labs

RAPTOR Labs is where our threat model gets smarter. We turn threat data into intelligence, detect the patterns behind it, predict what comes next, and run an agentic improvement loop so the whole RAPTOR ecosystem learns from itself and improves with every cycle.

• 01Threat data
• 02Intelligence
• 03Pattern detection
• 04Prediction
• 05Agentic improvement loop

RAPTOR turns shared emails, documents and links into distributed counterintelligence sensors. Standards-based instrumentation returns protocol-level signals across third- and Nth-party access without recipient software, special portals or RPost storing content. Super Intelligence (SI) correlates signals to flag suspicious access, compromised partners and hidden exposure paths. This metadata intelligence layer becomes the foundation for PRE-Crime™ preemptive agentic actions.

• LAYER 1 · ORCHESTRATOR, ENGINE, MODEL

  RAPTORRuns the pipeline

  Included in every email, document and e-signature envelope. The PRE-Crime™ engine collects protocol data, the customer's policies define what is a risk, and the model analyzes content activity, recipients, connections and devices. When the signals show risk in the content it triggers the AI Classification Agent, the AI Alert Agent that communicates to the organization, and the AI AutoLock Agent. The Forensic Un-Leak Evidence Agent then keeps a forensic record of what was un-seen, evidencing non-breach or isolating the precise content that was leaked.

  OutputAlerts and locks for the organization, and the model every team reports back into.

• LAYER 2 · AT THE METADATA

  OWLEnrichment

  Sits where RAPTOR collects the metadata. Breaks the protocol data into more data points and cross-analyzes them: browser versions against OS versions, IPs, locations, the domain age of URLs. When it finds a new set of relevant data it reports back, so RAPTOR learns to identify and detect better moving forward.

  OutputNew data points, fed back into the RAPTOR model.

• LAYER 3 · AT THE ALERTS

  HAWKThreat hunting & counterintelligence

  Sits where the alerts have been generated. Finds activity that looked normal but is suspicious, elevates the false negatives RAPTOR passed as expected, and groups patterns into threat actors, global organizations and state-backed attackers. Proves fingerprints on vast amounts of data, matches duplicates and promotes the most relevant to OSPREY.

  OutputProven fingerprints and pattern groups promoted to OSPREY: past patterns that predict future attacks.

• LAYER 4 · ACROSS ALL CUSTOMERS

  OSPREYGlobal intelligence

  Sits across the entire customer ecosystem, fed by RAPTOR, OWL and HAWK. Identifies widespread attacks that target different industries the same way, builds global fingerprints every industry benefits from, refines the fingerprints HAWK sends, and gives threat actors an identity and a way of operating.

  OutputNew triggers promoted to the RAPTOR model. The source of truth for the RPost proprietary model of intelligence.

Agentic Improvement Loop

RAPTOR harness · 46 s loop

Replay Pause

The harness, assembled step by step

01 RAPTOR 02 OWL 03 HAWK 04 OSPREY 05 The loops

RAPTOR · orchestrator, engine, model OWL · at the metadata HAWK · at the alerts OSPREY · across all customers Dashed lines feed the model · solid lines carry data forward

Click any step to jump to it. The diagram shows the order of work, not live data.

Back into RMail ICES

New threat fingerprints are infused into RPost email and content security products, including RMail ICES, so they super intelligently evolve continuously.