Case study · Security intelligence and AI

Security intelligence, built to answer one question: can our teams go there?

A security platform built and delivered for an organisation operating across the DRC. It brings field alerts, press monitoring and the organisation's own documents into one place, gives an outlook for the next 48 hours zone by zone, and prepares the reports its security team circulates, in French and in English. The client and its data stay confidential.

Client delivery, 2026 Built end to end, January to August Client and data confidential
9
Modules

From the live overview to training follow-up, in one application.

5
Report types

Each in French and in English, ready to review in Word or to send as PDF.

7
Zones followed

Each with its own 48 hour outlook and recommendations.

2
Languages

The whole interface, the assistant and the reports work in French and English.

The use

What it gives a security team

A humanitarian security team in the DRC has one recurring question to answer, several times a week and sometimes several times a day: can staff travel to this area, and under what conditions. Answering it means reading field alerts, following local and international press, remembering what past reports said, and knowing the names and acronyms of dozens of armed groups and institutions.

The platform gathers all of that in one place and turns it into four things the team uses every day: a live picture of incidents on a map, an assistant that answers questions from the organisation's own documents, an outlook for each operational zone, and the formal reports the team signs and sends.

The platform prepares the answer and shows where it comes from. The decision to send a team stays with a person.

The modules

Nine modules, one picture

Each module answers a different need of the team, and all of them read the same information, so a figure on the map, in a report and in the assistant is always the same figure.

Figure 1: what each module does

The nine modules of the application, as the team finds them in the menu.

Module
What it does
Overview
The situation at a glance: key figures, the month's trend, the latest incidents.
Tactical map
Every incident placed on the map, filterable by zone, period and type.
Incidents
The full list of incidents, with their details, actors and sources.
Field alerts
Alerts from the organisation's own network, as they come in.
Forecasts
A 48 hour outlook for each zone, with recommendations for staff and convoys.
Reports
Situation reports, advisories, bulletins and notes, prepared in both languages.
Press review
Local and international press on security in the DRC, sorted and summarised.
Document sync
The organisation's documents, kept up to date so the assistant can use them.
Training
Who has completed which security training, and who still needs to.

The picture

One incident, counted once

The same event can reach a security team four times: from its own network, from a local radio, from an international outlet, from a conflict database a week later. Counted four times, it distorts every indicator built on it.

The platform brings those sources together and recognises the same event under different descriptions, so the map, the charts and the reports all count it once. Monthly figures follow the date an incident happened, not the day it was entered, so a late report does not make a quiet month look violent.

Figure 2: from sources to decisions

What goes in, and what the team gets out.

Sources
What comes in.
Field alerts from the organisation's networkLocal and international pressThe organisation's own documents
The platform
One shared picture.
Each incident recognised oncePlaces, actors and casualties identifiedEverything searchable in one place
The team
What it uses.
Map and dashboardAssistantZone outlooksReports in two languages

The outlook

A recommendation, with its reasons and its confidence

For each zone, the forecast module gives what a security manager needs before approving a movement: an operational decision, a recommendation for staff and one for convoys, the main threat, what would trigger a review, and an outlook for the next 48 hours, from stable to imminent escalation.

Every outlook comes with how confident the system is, and why. A zone with many recent, corroborated incidents gets a firm answer; a zone with little information gets a cautious one, and says so. The recommendation is written in plain language, but it rests on the incidents behind it, which the team can open and check.

And the page always answers. If an external service is slow or unavailable, the team still gets an outlook, simply marked as less certain. For someone deciding whether a road is safe tomorrow morning, a cautious answer is better than an empty screen.

The assistant

Ask a question, get an answer from your own documents

The assistant answers questions in French or English, the way a colleague who had read everything would: what happened in this territory last month, which groups are active on this axis, what the last advisory recommended.

Its answers come from the organisation's own reports and documents and from the incidents in the platform, and it cites where each answer comes from. It knows the acronyms of the DRC security landscape, so a question about a group or an institution gets the right one, even when it is written in a shortened or misspelled form.

The reports

Reports that read like the team wrote them

Written reports are one of the most time-consuming things a security team produces. The platform prepares five kinds, each in French and in English.

The figures and charts in a report come straight from the platform's data, never from the text generation, so a report can never state a number that the dashboard does not show. The writing follows the organisation's own style: its structure, its vocabulary, its tone. Each report arrives as an editable Word document, because the analyst reviews and corrects it before anything is sent, and as a PDF for circulation.

Figure 3: the report catalogue

Five types, each available in French and in English.

Report
What it is for
Situation report
The weekly picture: what happened, where, and what it means for operations.
Security advisory
A targeted warning on one threat or one area.
Monthly bulletin
The month in review, for a wider readership.
Analytical note
A deeper reading of one dynamic, with a risk matrix.
Scenario note
Possible developments, and what each would mean for the teams.

Access

Who can see what, and who can act

A security platform holds information that should not circulate freely. Each account has a role, and the difference that matters is not only between seeing and not seeing, but between seeing and acting: some accounts can consult everything without being able to change anything.

The whole application is bilingual, because the team works in both languages and its readers do not all read the same one.

The limits

What this platform does not do

It does not decide. The outlook is decision support: a structured opinion, with its evidence and its confidence, for a person who remains responsible for the decision.

It is only as complete as its sources. Some areas are covered every day, others almost never, and a zone the press is silent about is not necessarily a quiet zone. The platform gives more weight to the organisation's own field reports for exactly that reason.

To close

AI that writes, figures that stay put

The temptation with a project like this is to let an AI write a confident answer to every question. The work was mostly the opposite: deciding what the AI is allowed to do, keeping every figure tied to the data, and making sure the platform still answers when something fails.

What I take from it is that in a high-stakes setting, the useful AI is the one that shows its sources: it writes, explains and summarises, while the numbers and the decision stay where a person can check them.

Method

The detail, for anyone who wants to check

Delivered
A complete web application, from data collection to report export, built and delivered to the client between January and August 2026.
Sources
Field alerts from the organisation's network, local and international press, and the organisation's own documents.
Outputs
A live dashboard and map, zone outlooks, an assistant, and five types of reports in French and English, in Word and PDF.
Users
The organisation's security team, with accounts and roles.

Confidentiality. The client is not named, and no incident, place, figure or screenshot from the platform appears on this page. The diagrams describe what the platform does, not its data.

Detail. The platform belongs to a client delivery. A demonstration can be arranged on request, within what the client allows.

← Back to portfolio