The surfaces we do not hold ourselves.
A state's exposure is not one problem. The information environment can be manipulated, people can be turned or wrongly appointed, the technical perimeter can be breached, and the infrastructure the data itself runs on can be compromised or offshored. Black Cube Defence holds the information environment through the DSM-SOC. Three partners hold the rest — independently owned, independently accountable, and deliberately kept distinct so a client always knows who is answerable for what.
The questions the public record does not contain
Licensed South African private-investigations practice. The investigative and field capability behind our human-domain line — human threat intelligence, insider threat programmes, advanced vetting and lawful human-source collection.
maximumnotion.co.za →Everything an adversary can reach from outside
Exposure and vulnerability management: attack surface management, penetration testing as a service, threat intelligence, credential-breach monitoring and identity security. Discover, test, prioritise, fix — continuously.
outpost24.co.za →The data itself, protected in use
Infrastructure and AI security: confidential computing, confidential AI, sovereign data residency and production AI implementation — so sensitive workloads stay protected even from the operator running them.
canarybit.co.za →Why the separation matters to a state client. Maximum Notion works the human domain; Outpost24 secures the perimeter; Canarybit protects the vault; Black Cube Defence works the information environment. Each is separately contractable and separately accountable — a government can commission one, several or all of them without a single vendor holding the whole surface.
One incident, four disciplines.
In the specimen scenario the DSM-SOC establishes what can be established from public data: 214 accounts documented behaviourally, attribution tested against four hypotheses and held at MODERATE, the response measured from 26% share of voice down to 7%. Three questions remain that the platform is honest about not being able to answer alone.
Who commissioned it?
Specific-actor attribution is not possible from public data alone, and the report says so. One diagnostic item — an infrastructure payment, a contracted agency, a former employee's account of the brief — changes the leading hypothesis. It is obtained lawfully, graded on the same scale, or it is not reported.
maximumnotion.co.za →Did they get in first?
A document-drop is the escalation risk on every allegation-led campaign. Attack surface management, credential-breach monitoring and identity security answer whether the "leaked documents" could have a real origin — before the state has to say so publicly.
Where does the evidence live?
An evidence vault holding a state's reputational casework is itself a target. Confidential computing and sovereign residency keep the analysis protected in use — and keep the data inside the jurisdiction that owns it.
Delivery capability behind the work.
Sovereign programmes rarely stop at the technology. Two further partners carry the capability behind delivery: the engineering practice that builds the platform, and the infrastructure developer that knows what a national programme looks like from the inside.
Ai Software Development
Production AI engineering — document intelligence, workflow automation, intelligent search and in-product assistants. The build capability behind bespoke platform delivery and the Phase 3 model work.
aisoftdev.co.za →JUA Investments
Independent power producer developing, financing, owning and operating renewable assets across Africa. Where a national programme under scrutiny is an infrastructure programme, the delivery side is understood first-hand.
juainvestments.co.za →