Project Aegis: Decision Superiority, Built to Be Owned

Defence intelligence has an awkward shape. The volume of open material available to an analyst is effectively unbounded and grows continuously, the questions being asked of it change from one hour to the next, and any answer produced has to survive scrutiny from people who will act on it. Most platforms built for this problem address the first of those three and leave the other two to the organisation using them.

For a ministry at war there is a further constraint, and it has become the governing one. A system that cannot be run, inspected, modified and extended by the organisation itself is a dependency, and sovereignty has therefore moved well beyond a preference expressed during procurement, into a condition of the system being useful at all.

Aegis was built against that constraint from the first commit. It is a decision-superiority layer for unmanned systems operations across air, land and sea, sitting between an organisation’s intelligence stack and the systems that execute against it. The source, the schema, the model weights, the evaluation assets and the operating documentation are all held by the client, on infrastructure the client runs.

Ingestion

Eleven live source adapters run in production, spanning open web and broadcast material, social channels, geospatial and thermal observation, air and maritime track data, signals, satellite imagery, terrain, and telemetry taken directly off the airframe. Each implements the same compact contract, which is what allows a new source to reach production in one to two days rather than one to two quarters.

That contract is deliberately indifferent to what it is fed. Open material is the demonstration corpus because an unclassified prototype can only use open material, and the same architecture accepts classified imagery, signals and partner sovereign feeds without structural change.

The picture refreshes every few minutes, with separate hourly analytics and state-refresh passes running alongside. The distinction between that cadence and a nightly one is the distinction between a briefing document and a live operating picture, and closing the distance between the two is where most of the engineering sits.

Scale

Aegis has collated, ingested and interpreted over 700 million intelligence updates drawn from open sources, platform telemetry and the course-of-action engine. The figure describes continuous re-evaluation rather than accumulation, since the system re-scores, re-links and corrects prior state each time new material arrives, which is what allows command and control decisions, including kinetic ones, to be taken against a current picture instead of a remembered one.

Mission and flight intelligence

Flight logs from PX4, ArduPilot and generic MAVLink sources are parsed into a single canonical telemetry schema, from which more than twenty per-mission features are extracted and every mission enriched with the weather, terrain, land use and solar position obtaining at the point and time it flew.

Analysis runs deterministically, with a deliberate bias toward contested-environment and electronic-warfare indicators over routine vehicle health, so that link-margin collapse, GNSS denial corridors and flight-mode churn are treated as first-class detections. Anomalies that co-occur and overlap in time compose into named failure archetypes, among them electronic-warfare suppression events and navigation failure cascades, which in turn classify into failure classes and score into a mission health score.

Computer vision over defensive positions

A segmentation model identifies and plots field fortifications from satellite imagery across four classes, being infantry trenches and anti-tank ditches, dragons-teeth concrete blocks, dry moats, and caponiers as enclosed firing positions.

Training uses weak supervision, taking vector polylines from an existing mapped corpus as labels so that the model learns the visual signature of defensive earthworks without anyone hand-drawing a training set. Evaluation tiles are drawn from geographic regions disjoint from the training set, which is the only arrangement under which the resulting score means anything.

38,653 defensive-structure polylines have been vectorised through the pipeline to date. A map of field fortifications drawn by hand is accurate on the day it is drawn and decays steadily from that point, which is why the pipeline was built to maintain its own output, proposing candidate structures in fresh tiles for operator confirmation and returning every confirmation or rejection to the model as a label.

The knowledge layer

The models produce observations. Turning a stream of observations into something that can be reasoned over is the work of the knowledge layer, and it is the part of Aegis that took longest to get right.

Across a corpus of several hundred confidential documents, the system built a typed ontology running to thousands of entities and tens of thousands of typed relationships, extracted on device, with no material leaving ministry infrastructure at any stage. Every entity in that graph has since been re-evaluated on the order of a hundred thousand times.

The ontology is owned by the ministry and evolves as the conflict does, which is what converts 700 million raw intelligence updates into a structure capable of answering a question. Typed relationships are what make that possible, allowing the system to establish what connects two things, and through whom, without exporting anything to a third party for inference.

Courses of action

Aegis produces ranked course-of-action bundles for each nominated target, using deterministic feasibility-first ranking across eighteen archetypes. Ranking combines Beta-Binomial conjugate priors with Thompson-sampled exploration, k-nearest-neighbour retrieval over historical success, and a hand-built Bayesian network for explainable risk, so that each bundle arrives carrying a calibrated probability of success and an operational-history posterior.

Joint archetypes orchestrate coordinated cross-domain packages with time-on-target offsets, pairing a maritime terminal phase with a long-range fixed-wing battle-damage-assessment orbit, or ISR overwatch with a time-aligned strike commit.

Routing is threat-aware A* under weather gating, airframe packs, launch-window selection and class-aware safety margins, governed by a success-probability model with time-pressure-driven urgency decay. Worst-case plan generation completes in 3.2 seconds against corridors carrying between one and seven thousand hazard points, and the full sequence from promotion through pairing, approval, release and route generation runs in five to six seconds on the command map.

Provenance

None of the above is usable unless it can be defended afterwards, which is why the audit surface was designed alongside the analysis rather than added to it.

Every decision traces back to the sources that produced it, and effect-graph replay reconstructs any operator action step by step with an inverse-rollback path available. Lifecycle state machines govern targets, mission plans and manoeuvre tasks, publishing a schema-validated event on every transition. Inference is canary-tested with drift monitoring, and anomaly detection runs over the audit log itself. Access is scoped by role and enforced at the data path, so what a user can see is a property of the system rather than a matter of configuration discipline.

In a domain where an assessment may be challenged months after the fact, provenance does functional work.

The operating environment

Aegis was built for conditions that break most commercial platforms. It runs on ministry-owned infrastructure, operated by the ministry, and is deployable by nations that cannot or will not run on another country’s cloud. It is air-gapped and offline capable, with no dependency on an external inference service to function. Jamming, GNSS denial and degraded connectivity are modelled as first-class detections rather than treated as exceptions. The architecture is open, exposing REST and a canonical event stream, with no proprietary autopilot or radio dependency anywhere in it.