Allegory.

Connect what happened, what it meant, and when

Allegory is Cratylus behavioral intelligence engine. It builds a connected history of how people react to critical topics, learns their individual patterns, and flags sustained changes in those reactions. For insider threat teams, that history shows how a trusted person’s stance, tone, and framing evolve over time, with linked evidence behind each finding.

The foundation is Cognitive Retrieval-Augmented Generation, or Cognitive RAG: semantic retrieval and graph context working together to give AI a richer basis for interpretation. Every analysis begins with evidence about who responded, what they responded to, and how that response fits into an established history.

A graph of people, information, and reactions

Allegory connects public profiles with their posts, replies, quotations, reactions, and linked web content. Topic analysis establishes meaning across conversations. Semantic matching connects related topics across conversations, while the graph preserves the paths from a person’s response to the information behind it.

These relationships preserve distinctions that matter. An article, a post describing it, and a reply criticizing that post are separate pieces of evidence. Allegory uses their connections to interpret whose view is being expressed and which topic that view concerns.

Behavioral baselining

Allegory creates a longitudinal view of a person’s expressed stance, emotional tone, and engagement. These dimensions help explain how a response is expressed. Someone can support a policy while expressing fear about its consequences, or use positive language sarcastically to criticize it. Thread context, quotations, and the target of a reply help Allegory interpret these differences. It then uses that history to establish a baseline grounded in the individual’s own observed patterns.

As new evidence arrives, Allegory compares it to the associated individual's baseline and tracks how the pattern evolves. Changes in stance, intensity, and the subjects a person engages are examined together. The analysis considers the strength of the evidence, the persistence of a change, and the surrounding information environment when bringing a departure from that individual's baseline to the attention of security or human resources.

For an insider threat team, this creates a focused starting point: what changed, when it changed, and which observations support that interpretation. The reviewer can then relate the finding to the person’s role, circumstances, and other relevant information.

Make sustained departures reviewable

An alert brings together the earlier pattern, more recent reactions, and observations showing that a shift is sustained. The reviewer can follow the timeline, read the original exchanges, and assess the strength of any change. An isolated reaction can be considered within that history without being treated as a sustained pattern on its own. Often, it's not the employee who always complains who's the problem, but the employee who's raised no flags who suddently and over a sustained length of time shows troubling behavior.

As further evidence arrives, the individual's monitored history gives the firm's insider threat team the framework for examining whether the change continues, becomes more pronounced, or settles back toward the person’s established pattern. That context helps determine whether a concern calls for clarification, support, or investigation.

By focusing on the change in trend over time, an individual simply having a single "bad day" will not trigger a flag, thereby reducing noise and preventing unnecessary reviews by security teams.

Keep interpretations traceable

Datapoints and security reviewer interactions are stored using a cryptographic ledger to provide full forensic evidentiary chains for use in investigations and prosecutions. There is no doubt about the accuracy of the data in the system.

From behavioral understanding to a considered response

Allegory brings together the individual baseline, the trajectory of change, and the information environment around it. A departure can prompt a closer look, a supportive conversation, or a security review. Behavioral change alone establishes neither harmful intent nor a person’s need for intervention or support; the evidence and its context merely guide the human decision.

Explore the insider threat application, or request a technical briefing on the methodology, data coverage, and evaluation of Allegory for your organization.