Roe Atlas
The shared map
of financial crime.
A consortium knowledge base of fraud and financial-crime typologies, attacker tactics, indicators, and anonymized pattern cases. Built to power investigation agents and the analysts who work beside them.
Every team fights
the same attackers.
And fights them alone.
Attackers share playbooks. A tactic proven against one platform crosses the world in days. Defenders lock their hard-won investigation knowledge inside the building: in analysts' heads, in closed cases, in SOPs no one else will ever read.
Atlas turns that private knowledge into a shared, structured corpus. Contributed by working investigators. Reviewed by peers. Inherited by the whole network.
Structured the way
investigators think.
Five levels deep. From the named typology down to anonymized real investigations, with lookalikes and counter-examples at every level so precision survives contact with production.
Account takeover,
tactic by tactic.
A slice of one Atlas entry. Each tactic maps to lifecycle stages, the indicators that fire at each one, and the precedent cases behind them.
Breached email and password pairs replayed at scale, then the hits are walked through the owner-lockout sequence and drained.
Lifecycle
Indicators that fire
- Login from a never-seen ASN or device
- Password reset minutes before a new payee is added
- Failed-login burst across many accounts from one network
Counter-examples, recommended rules, and anonymized precedent cases ship with the full entry.
Ask it from the chat
you already use.
Atlas ships as an MCP server. Connect it to Claude or ChatGPT and every risk question your team asks comes back grounded in the typology map: named tactics, live indicators, and precedent cases, cited.
Claude
ChatGPTThis looks like account takeover: stolen credentials, then a password reset to lock the real owner out, then money out to payees the customer has never paid before. Atlas tracks the tactic as credential stuffing → reset → drain. Before working the queue, have your team pull:
One thing to rule out first: if you emailed customers prompting password resets recently, the resets may be your own campaign. Atlas lists that as the top counter-example for this tactic.
Source: Roe Atlas · Account takeover · credential stuffing → reset → drain · 9 indicators · 1 pattern case
Built into Rori.
Or into your own agent.
With Rori Agent OS
Every case, anchored to the map.
Rori agents consult Atlas on every investigation: routing to the right typology, checking counter-examples before concluding fraud, and citing precedent cases in the disposition. Nothing to configure.
Building your own agents
One connection away.
Atlas ships as an MCP server. Point your in-house agent at it and it inherits the full corpus: typology routing, indicators, counter-examples, and case retrieval as callable tools.
ChatGPTClaudeEvery contribution makes
the whole network smarter.
01
Contribute
Working SMEs add tactics and anonymized pattern cases from real investigations.
02
Review
Peers dispute, refine, and attach counter-examples until the entry survives scrutiny.
03
Compound
The corpus sharpens, and every agent and analyst on the network inherits it.