Threat
Intelligence
Platform

TLM42 is a threat intelligence platform that treats investigation as a collaborative act between analyst and AI. Built for Security Operations Centres (SOCs) and CISOs, it gives analysts an adaptive investigation workspace: load evidence, an IP address, a file hash, a PDF report, a screenshot, an alert, and the platform analyses it, enriches it with related IOCs and threat actors, and surfaces AI reasoning that can be traced, edited, and shared. Every output is portable: reports, actor profiles, and IOC collections export in the formats the recipient actually uses (PDF, .docx, STIX JSON) without requiring a login or a special tool on the other end.

GenLab-Studios is a design and product studio built around a single premise: that the gap between design and engineering has closed enough to collapse them into one workflow. TLM42 is our first product. The question we started with wasn't "what should a threat intelligence platform look like?" It was "what does a design process look like when the gap between concept and working prototype is measured in hours?"

We ran structured async audio interviews with five users across the distinct roles that converge on a threat intelligence platform: a TI Analyst focused on IOC triage, a TI Analyst specialising in threat actor attribution, a TI Analyst covering threat landscapes, an IR Analyst handling active incident correlation, and an IS Manager responsible for board reporting. Five principles came out of the interviews: evidence first (not prompts), show your work always (AI reasoning must be traceable), enrich in the background (never a modal), every output must be portable, and the interface follows context not role.

The single most important design decision in TLM42 is that the AI's reasoning is always visible alongside its output, not buried, not available on request, always on. This came directly from research. Every analyst we spoke to had been burned by black-box AI output: a clean answer with no provenance, no way to check whether the underlying sources were reliable, no way to share the reasoning chain with a colleague who needed to act on it. Hiding the thinking doesn't make the interface cleaner. It makes the tool unusable for serious work.

TLM42 was never designed in static screens. Every iteration was a live, interactive prototype, tested in the browser. The AI-native toolchain, Pencil.dev for wireframing, Lovable for live prototype generation, Figma Make and Stitch for design-to-code, Claude Code for custom interaction logic, Linear and Git for version control, replaced traditional handoff with a live navigable HTML prototype that the full team could use, test, and demonstrate. Ten versions. The current state: a minimal interface that disappears behind the work. The canvas, the reasoning, the evidence. Those are the product. The chrome is not.