Behavioural Threat Intelligence for People and Narratives Read the person and the message: behavioural signals from faces, influence tactics from language, each with the evidence behind it
EchoDepth Defence gives security, intelligence and communications teams a structured view of the human layer. The face engine reads stress, suppression, fatigue and behavioural drift from existing RGB cameras to support insider threat, credibility assessment and operator readiness. EchoDepth Signal reads language: the tactics and narratives in hostile messaging, and how your own crisis communications are likely to land. Analyst-led. On-premise deployment. UK data residency.
Your security stack monitors systems.
EchoDepth monitors people, and the narratives aimed at them.
Cyber, access control and surveillance platforms detect digital events. EchoDepth adds the missing human intelligence layer: behavioural drift, stress, fatigue and suppression signals in your people, and the coercive and manipulative language directed at them and at the public.
You Cannot Vet What You Cannot See
Security clearances and annual reviews catch nothing in real time. Stress indicators, behavioural anomalies, and emotional changes that precede incidents go entirely undetected by existing TSCM and access control infrastructure.
// COST PER INSIDER INCIDENT: £3.2M AVERAGE
Completion Rates Measure Nothing
A 2025 survey of compliance professionals found 74% report employees forget what they learned within a month — not skipped training, but training that was attended while disengaged. You have no measure of whether it landed.
// 74% FORGET WITHIN A MONTH: SOURCE SKILLUP 2025
Fatigued Operators Make Critical Errors
Drone pilots, SOC analysts, control room operators, and intelligence reviewers face sustained cognitive load with no real-time monitoring. Fatigue is invisible until an incident occurs.
// FATIGUE FACTOR IN 23% OF MILITARY NEAR-MISSES — NATO REVIEW
Polygraph Is Pseudoscience. You Know It.
Courts and procurement officers are aware that polygraph lacks scientific validity. Border screening, interview assessment, and source credibility require a defensible, evidence-based alternative.
// POLYGRAPH FALSE NEGATIVE RATE: UP TO 47% IN CONTROLLED STUDIES
Hostile Narratives Outpace Manual Review
Coercive and manipulative messaging aimed at personnel, sources and the public spreads across channels and changes as it goes. Analysts read it by hand, one channel at a time, so emerging patterns are often recognised late.
// TRIAGE, NOT VOLUME, IS THE BOTTLENECK
You Learn How a Statement Lands After It Lands
Crisis statements are drafted under time pressure and checked by colleagues who already know what they mean. Misreadings surface once the statement is public, when correcting them costs credibility.
// TEST THE WORDING BEFORE IT IS PUBLISHED
Analyse the message,
not just the messenger.
EchoDepth Signal already analyses written statements for linguistic deception markers. We are extending it to narrative analysis for counter-influence and crisis communications teams. The four functions below are in development with defence and government design partners, and each is being tested against a specific analyst benefit before release.
In development · design partners wantedIdentify intimidation, coercion, urgency and scapegoating
Flags language consistent with known pressure and manipulation tactics in messages, posts, letters and transcripts, so material can be sorted before anyone reads it in full.
Why it mattersHelps analysts prioritise which material to review first.
Compare how narratives shift across messages and channels
Tracks how a narrative is framed as it moves between messages, platforms and audiences over time: who is blamed, what is demanded, and which claims are added or dropped.
Why it mattersHighlights emerging patterns while there is still time to respond.
Show the passages behind every assessment
Each finding links to the exact passages that support it, with a stated level of uncertainty. Nothing is scored without its source, and the analyst can accept, reject or annotate each one.
Why it mattersMakes findings reviewable, challengeable and defensible.
Test draft statements against simulated audiences
Runs a draft crisis statement past simulated audience panels to show where wording is likely to be misread, distrusted or escalated, before it is published.
Why it mattersHelps teams improve clarity and reduce misunderstanding.
Nobody else is going to warn you. You have until midnight to decide. This happened because your unit covered for them. We know who you work with.
Built the way analysts already work.
Narrative analysis follows the same rules as the face engine: it surfaces evidence and uncertainty, and a trained analyst makes the call. It flags language consistent with a tactic. It does not judge intent, attribute authorship or profile individuals.
It is aimed at hostile-state and influence-operation material, threats received by personnel, and your own organisation’s communications. It runs on-premise with the rest of the platform.
Six Capability Areas. Two Engines.
One analyst-led platform. The face engine reads behavioural signals from existing cameras; EchoDepth Signal reads language. Together they cover the human intelligence gaps in defence and security operations. View all solution areas →
Know if Training is Actually Landing
Real-time engagement and comprehension scoring during mandatory training. DSAT-compatible audit records. LMS integration. Objective evidence that training is retained, not just completed.
Explore Solution → 02 Insider Threat Behavioural DriftContinuous Behavioural Anomaly Monitoring
Behavioural baseline profiling per individual. Anomaly scoring when patterns deviate. SIEM integration. Earlier signal detection for earlier intervention before incidents occur.
Explore Solution → 03 Cognitive Readiness MonitoringQuantify Human Readiness. Live.
Pre-mission readiness scoring, live fatigue and cognitive load monitoring, and post-incident timeline reconstruction for UAS, SOC, and control room operators.
Explore Solution → 04 Credibility and Deception AssessmentAnalyst-Led Behavioural Signal Analysis
FACS-compliant Action Units per frame. Timestamped per-question stress and suppression mapping. Structured analytical output for intelligence and legal review.
Explore Solution → 05 Narrative & Influence Analysis In developmentRead the Tactics in Hostile Messaging
Linguistic tactic identification, cross-channel narrative comparison and passage-level evidence with stated uncertainty, for counter-influence and threat assessment teams.
Explore Solution → 06 Crisis Communications Testing In developmentKnow How a Statement Will Land
Test draft crisis communications against simulated audience panels and see where wording is likely to be misread, distrusted or escalated, before it is published.
Explore Solution →Facial Action Units.
Decoded at Scale.
Standard RGB camera. 68-point facial landmark detection. 44 FACS-compliant Action Units extracted per frame. VAD mapping. REST API or on-premise deployment. Works with your existing camera infrastructure — no specialist hardware required.
Full Technical Overview →Processing pipeline · API & integration · Deployment options
🔒 Air-Gap Ready
Full on-premise Docker deployment. SCIF-compatible. Zero external data transmission at any stage.
⚡ ~700ms Latency
Sub-second emotional state output. Suitable for live interview and real-time operator alerting.
🌐 API-First
REST & WebSocket. Integrates with SIEM, LMS, C2. SDK: Python and Node.js.
🇬🇧 UK Data Residency
All data processed within UK borders. UK GDPR compliant. ISO 27001 pathway.
Analyst-Ready Output.
Not a Black Box.
EchoDepth Signal provides structured risk assessments with composite scores, category breakdowns, temporal deception trends, and prioritised red flag indicators. Every output is traceable to its source (Action Units and timestamps for video, exact passages for text) and is designed for analyst review, not automated decisions.
- ✓Composite risk score with confidence band
- ✓Category breakdown: deception, stress, suppression
- ✓Temporal trend analysis across interview timeline
- ✓Prioritised red flags with timestamp references
- ○Supporting passages and stated uncertainty for text findings In development
How does EchoDepth compare to existing approaches?
Existing tools monitor systems, devices, and digital behaviour. EchoDepth monitors the human, and the language used to influence them.
| Capability | Polygraph | UEBA / SIEM | Wearable Sensors | EchoDepth |
|---|---|---|---|---|
| Real-time continuous signal | Session only | Digital events only | Physiological only | ✓ Continuous AU analysis |
| No contact or wearables | ✗ Physical sensors | ✓ | ✗ Worn device | ✓ Camera only |
| Works on existing cameras | ✗ | ✗ | ✗ New hardware | ✓ Existing CCTV / webcam |
| Reads emotional / cognitive state | Indirect | ✗ | Partial | ✓ 44 FACS Action Units |
| SIEM / platform integration | ✗ | ✓ Native | Partial | ✓ REST API / WebSocket |
| Air-gap / SCIF deployable | Examiner-held | Partial | ✗ | ✓ Full on-premise / Docker |
| Analyses influence tactics and narratives in language | ✗ | Keyword rules | ✗ | ◐ Signal (in development) |
| UK data residency standard | ✗ | Varies | Varies | ✓ Default |
What procurement teams ask first.
What is EchoDepth, and how does it work?+
EchoDepth is a behavioural threat intelligence platform developed by Cavefish in Cardiff, Wales, with two engines. The face engine analyses 44 FACS-compliant facial Action Units per frame in real time to surface stress, deception indicators, cognitive overload and operator fatigue, using only a standard RGB camera. EchoDepth Signal analyses language, and is being extended to narrative and influence-tactic analysis. Both deploy fully on-premise with no cloud dependency.
Does EchoDepth analyse language and narratives?+
EchoDepth Signal already applies forensic statement and linguistic analysis to written statements and transcripts. Narrative analysis is in development with defence and government design partners. It identifies language consistent with intimidation, coercion, urgency and scapegoating; compares how narratives change across messages and channels; shows the supporting passages for each assessment with stated uncertainty; and tests draft crisis communications against simulated audience panels. Every output is for analyst review, not automated decisions. Join the design partner programme.
Is EchoDepth a genuine polygraph alternative?+
Yes. The National Academy of Sciences found in 2003 that polygraph lacks scientific validity for security screening, with false negative rates up to 47%. EchoDepth uses 44 peer-reviewed FACS Action Units to produce timestamped, structured analytical output — a documented, evidence-based record that withstands legal and procurement scrutiny. It does not claim to detect lies; it surfaces involuntary physiological markers correlated with deception attempts. See the full credibility assessment capability overview.
Can EchoDepth operate in a SCIF or air-gapped environment?+
Yes. EchoDepth is fully deployable on-premise via Docker with zero external data transmission at any stage. No cloud dependency, no telemetry, no outbound network calls. All inference runs locally on standard server hardware. See full deployment specifications or request an air-gapped demo via the briefing request form.
What hardware is required?+
EchoDepth requires only a standard RGB camera at minimum 720p. Existing CCTV, interview room cameras, or laptop webcams qualify. No infrared, no thermal imaging, and no specialist hardware is required. This makes it viable in interview settings, training environments, and control rooms where attaching physical sensors is impractical.
Is EchoDepth compliant with UK GDPR and defence data standards?+
EchoDepth processes biometric data with pseudonymisation by default, role-based access controls, and full audit logging. All data is processed within UK borders as standard. The platform is aligned with NCSC principles, on the ISO 27001 certification pathway, and produces DSAT-compatible audit records. A full data processing agreement is available under NDA on request.
See What Your Security Stack
Is Missing.
Structured technical briefings for defence procurement, security leadership, intelligence and strategic communications teams. NDA available. Air-gapped demo environment on request.
DEFENCE@CAVEFISH.CO.UK · CARDIFF, WALES · UK DATA RESIDENCY STANDARD