For most of Syndu's life, the product remembered nothing for the customer unless the customer remembered it first.
You could read a report. You could call the Risk API. You could work through Syndu MCP.
But stitching those actions into one ongoing investigation was still your job.
That changes now.
We built a new logged-in workspace app called Workspace Memory.
It automatically records the entities you explored through:
- report shells
- Risk API score calls
- Syndu MCP investigation
Then it composes those actions into one owned weekly feed, one tracked entity set, and one live spike surface over the same memory.
That is the moment Syndu stops behaving like a set of helpful investigative tools and starts behaving like an investigative platform.
1. The feed is now automatic
The most important change is not visual.
It is behavioral.
Once a user is signed in, Syndu now writes a private investigation feed for that workspace:
- opened report shells
- Risk API score calls
- metered MCP interactions
Each action lands as part of one chronological memory stream.
That means an analyst no longer has to reconstruct what they touched last Tuesday, which city cluster they were following, or whether a spike they are seeing now belongs to a line of inquiry they had already opened.
The workspace itself now keeps score.
2. The right time unit is the work week
Security work is not only a moment-by-moment activity.
It is also cyclical:
- Monday triage
- midweek clustering
- late-week escalation
- repeated looks at the same entities as new evidence arrives
That is why the app is organized around a work week picker instead of a generic endless feed.
The user can move week by week through:
- activity by day
- total investigation actions
- distinct entities touched
- which surfaces were used
This is important because memory without navigation quickly becomes archive.
What we wanted instead was replay.
3. Private memory now connects to the live field
The strongest part of the new app is what happens after the feed exists.
Once a workspace has built a memory set, Syndu can compare that private entity set to the live communal field.
So the app does not stop at:
- what you looked at
It now asks:
- what inside your memory set is moving right now?
That is why Workspace Memory includes a live spike panel over the entities touched in the selected work week.
If a country, ASN, ISP, organization, subnet, or IP from your workspace memory is now spiking in the Q field, the app surfaces that immediately.
This is a very different product behavior from a static dashboard.
It is the beginning of an investigative assistant that follows the analyst's own trail and then reactivates it when the field moves.
4. Why this matters commercially
There is also a product strategy shift here.
An investigative tool waits for the user to ask.
An investigative platform accumulates the user's operational context and gets more valuable as that context deepens.
Workspace Memory moves Syndu toward the second model.
That matters because the real commercial threshold is not only more lookups.
It is more continuity.
When the workspace:
- remembers what was touched
- shows how the week unfolded
- keeps a reusable entity set
- reconnects that memory to live spikes
then the product becomes harder to replace with manual habits, screenshots, browser tabs, and scattered note-taking.
The analyst is no longer renting access to isolated surfaces.
They are building an operating memory.
5. What comes next
This release is the first layer.
It gives the customer:
- a private investigation feed
- a week-by-week replay surface
- a tracked entity set
- live spike awareness over that set
The next obvious step is user-facing alerting and deeper workspace automation around the same memory layer.
But even in its first form, Workspace Memory changes the nature of the product.
Syndu now does more than answer a lookup.
It remembers the investigation, organizes the work, and starts watching the field on the user's behalf.
