Feedback wanted: passive enrichment without overstating risk

[haizen1312]

I am working on the next OSINTPRO direction after early community feedback: passive enrichment paths with clear confidence labels.

The core problem is simple: a client report should explain why public evidence matters, but it should not turn weak correlations into certainty.

The current idea is to separate what the product shows into confirmed evidence, passive enrichment and inferred hypotheses. For example, DNS and HTTP observations are different from a possible typosquatting signal, and both are different from a CVE/KEV/EPSS risk path inferred from a technology/version signal.

The related issue is here: #7

I would like feedback from people who use OSINT, security reporting or fraud investigation tools: what would make this kind of risk path useful without making it misleading?