Africa's threat intelligence layer.
Pharos turns global threat signals into intelligence prioritised for Africa's threat landscape, helping security teams identify what matters, understand why it matters, and act faster.
Global threat feeds weren't built for African exposure.
Noise
Security teams receive huge volumes of indicators, many with little operational relevance.
Context
A globally malicious indicator does not automatically represent meaningful risk to an African organisation.
Analyst workload
Analysts spend time validating, enriching, correlating and prioritising intelligence.
From global signals to African intelligence.
Five stages, running continuously, from raw global feed data to Africa-scored, enriched intelligence delivered into your workflow.
Collect intelligence from multiple sources.
Reduce duplicate and overlapping indicators, and filter out known-benign ones.
Evaluate relevance, confidence and severity.
Add contextual intelligence, actor attribution and MITRE mappings.
Push intelligence through dashboards, alerts, API, webhooks, TAXII and reports.
Not every threat matters equally.
Pharos evaluates threat indicators against African context so security teams can prioritise intelligence that is relevant to their environment.
Whether the indicator's observed infrastructure or victim footprint traces back to the African continent.
Whether the indicator is tied to sectors with meaningful African exposure: financial services, telecommunications, government.
Whether the indicator is linked to a threat actor with an established pattern of targeting African organisations.
Whether the indicator is referenced by an African national CERT advisory.
Four pillars, one intelligence layer.
Everything Pharos does falls into one of four areas: what it tells you, what it watches for you, how it connects, and how it reports back.
The core analysis layer, turning raw indicators into context security teams can act on.
Every indicator is scored 0–100 against geography, sector targeting, actor activity and regional advisory context.
AI-generated summaries, recommended actions and severity assessment for indicators above the relevance threshold.
A curated actor library with aliases, tooling and known TTPs, alongside AI-attributed actor context per indicator.
Related indicators are clustered into campaigns by our intelligence pipeline for deeper analyst-side investigation.
AI-suggested ATT&CK techniques attached to indicators to speed up technique-level triage.
New indicators are checked against known-benign sources such as popular sites, public DNS, CDN ranges and known-good files before delivery or enrichment. Suppressed indicators stay recoverable by our analysts.
Submit indicators and notes from your own environment. Analysts review each one. Approved submissions join the shared feed and run through the same scoring and enrichment pipeline, without your organisation's name or notes shown to other customers.
Visibility into what could affect your organisation specifically, not just the global feed.
Register IP ranges, CIDRs, domains, ASNs and email addresses. Pharos flags any indicator that matches, including malicious URLs hosted on your domains or addresses and phishing sent from your domain, and names the asset that matched.
Track vendors and suppliers by domain or IP, with a running risk score based on live indicator matches.
Monitoring for credential exposure and mentions across breach and paste sources.
Indicators are framed against the African infrastructure and sector landscape, not a generic global baseline.
Intelligence delivered into the tools your analysts already have open.
Programmatic access to Africa-relevant indicators, with severity and date filters.
A native TAXII 2.1 server with dedicated collections, ready for any TAXII-compatible platform.
Signed payloads for critical and high-severity indicators, delivered to your own endpoints within minutes.
Pull the Pharos feed into any platform that supports TAXII 2.1. Verified end to end with OpenCTI and the OASIS TAXII client.
Structured output for teams that need a record, not just a feed.
A curated digest of the week's relevant activity, scoped to your subscription tier.
In-platform, email and webhook alerts within minutes of high-severity, high-relevance activity being confirmed.
Digest content rendered as a shareable, archivable PDF.
Every indicator carries a TLP marking, with visibility gated by subscription tier.
What analysts actually see.
Representative Pharos interfaces, with sample data standing in where live product data isn't available on a public page.
Built with Africa in context.
Pharos is designed around African security environments, not a generic global feed with a regional filter bolted on afterward.
The relevance model is scoped to Africa's 54 nations from the ground up, not adapted from a US- or EU-centric baseline.
Indicators are evaluated against the sectors with real African exposure: financial services, telecommunications, government and energy.
Indicators referenced in African national CERT advisories carry additional weight in scoring.
Asset and supply-chain monitoring tie global indicator activity back to what an individual organisation actually runs and depends on.
Built for teams that carry African exposure.
Financial Services
Threat intelligence for banks, fintechs and payment infrastructure, prioritised for the sector's actual exposure.
Telecommunications
Visibility into threats affecting telecommunications infrastructure and downstream customers.
Government & Critical Infrastructure
Prioritised intelligence for environments where a missed indicator carries outsized impact.
Enterprise Security Teams
Reduce feed noise and let analysts spend their time on indicators that are actually relevant.
Security Operations Centres
Operationalise intelligence through the API, webhooks and TAXII rather than a manual feed review.
Put intelligence where your analysts already work.
Dashboard
The primary interface for analysts: live indicators, scoring and exposure in one place.
REST API
Pull Africa-relevant indicators, filtered by severity and date, directly into your own tooling.
TAXII 2.1
A standards-based TAXII 2.1 feed for platforms that can pull from a TAXII server. Verified with OpenCTI and the OASIS TAXII client.
Webhooks
Signed delivery of critical and high-severity indicators to your own endpoint within minutes.
Alerts
In-platform and email notifications within minutes of a monitored asset matching an indicator, naming the asset.
PDF Reports
Digest content rendered as a shareable, archivable document.
Pharos serves a read-only TAXII 2.1 feed of STIX 2.1 indicators, tested end to end with OpenCTI. Any platform that can pull from a TAXII 2.1 server can use it.
Machine-assisted intelligence enrichment.
AI helps analysts move faster. It does not replace intelligence discipline.
Pharos is a product of SentinelGrid Africa.
SentinelGrid Africa is a cybersecurity company working to secure Africa's digital frontier, bringing together threat visibility, intelligence and collaborative defence for businesses, governments and institutions across the continent.
Pharos is its threat intelligence product. SentinelGrid Africa builds it, runs it and supports it, and the same team is on hand during the private beta.
Visit SentinelGrid Africa
- Product
- Pharos
- Built and operated by
- SentinelGrid Africa Ltd
- Based in
- Port Harcourt, Rivers State, Nigeria
- Contact
- intel@sentinelgrid.africa
Regional context
SentinelGrid Africa builds for Africa's evolving threat landscape. In Pharos, that is the relevance score on every indicator.
Collaborative intelligence
Defence works better when teams share what they see. In Pharos, you can contribute indicators back for analyst review.
Built for Africa
Intelligence. Defense. Resilience. Built for Africa. It is the SentinelGrid Africa tagline and the brief behind Pharos.
Get early access to Pharos.
Pharos is currently available through private beta for organisations and security teams interested in Africa-focused threat intelligence.