VoidAccess brings self-hosted threat intelligence and local AI to security researchers

Security researchers and IT teams managing their own infrastructure now have a new option for organizing complex threat intelligence. VoidAccess, released in late October 2026, is a self-hosted platform designed to aggregate data from both the public web and Tor-accessible sources. It aims to replace scattered browser tabs with a unified interface for tracking domains, IP addresses, and malware indicators.

What happened

VoidAccess addresses the common problem of fragmented evidence during security investigations. Instead of manually cross-referencing disparate reports, the tool queries multiple sources simultaneously. It extracts technical indicators such as file hashes, domains, and known threat references. The system then organizes these findings into relationship graphs, allowing analysts to visualize connections between different pieces of infrastructure without constantly switching contexts.

The software is built for authorized investigations and emphasizes data sovereignty. By running the stack locally, teams keep their research queries and findings within their own network boundaries. The tool supports exporting data in industry-standard formats like STIX and MISP, as well as simpler CSV and Markdown files, ensuring that collected intelligence can be integrated into existing security workflows or shared with relevant stakeholders.

Key details

• VoidAccess is an MIT-licensed project with a documented security policy and self-hosting guide.
• The official deployment uses Docker Compose to run four services: PostgreSQL, Tor, a FastAPI backend, and a Next.js frontend.
• A Python command-line interface is available for users who prefer terminal-based workflows over the web UI.
• The platform supports local AI processing via Ollama, allowing interpretation of findings without sending data to external commercial providers.
• External enrichment services requiring API keys are optional and can be disabled to maintain a fully offline analysis mode for the AI component.
• The setup wizard automatically generates application secrets and database credentials to streamline initial configuration.

Background

Threat intelligence often involves correlating disparate data points to identify malicious actors or compromised systems. Traditionally, this requires accessing various public feeds, private reports, and sometimes dark web sources. Doing this manually is time-consuming and prone to error. Self-hosting such tools allows organizations to maintain control over sensitive data, ensuring that investigation details do not leak to third-party SaaS platforms.

VoidAccess leverages modern web technologies to separate the collection layer from the presentation layer. The backend handles the heavy lifting of querying Tor networks and parsing security feeds, while the frontend provides a visual graph interface. This architecture is common in modern DevOps stacks, where services are containerized for easier management and isolation. The inclusion of local AI models reflects a growing trend in privacy-focused software, where computational tasks are performed on-premise to avoid data exfiltration risks.

Why it matters

For teams that run their own software, maintaining control over security research data is critical. Using cloud-based threat intelligence platforms often means sending internal indicators of compromise to external servers. VoidAccess allows these teams to conduct deep-dive investigations without exposing their specific targets or findings to third parties. This is particularly important for industries with strict compliance requirements or those dealing with highly sensitive intellectual property.

The ability to visualize relationships between threats helps analysts prioritize their response efforts. A simple list of suspicious IPs may not reveal a broader campaign, but a graph showing shared infrastructure can highlight a coordinated attack. However, the tool’s documentation warns that these connections are not proof of ownership. Shared hosting and recycled infrastructure can create false positives, so human verification remains essential. The tool serves as an aid to decision-making, not an autonomous authority.

Furthermore, the option to use local AI models reduces operational costs and privacy concerns. Teams can leverage large language models to summarize findings or suggest next steps without incurring per-token fees or risking data leakage. This makes advanced analysis accessible to smaller teams or homelab enthusiasts who may not have budgets for enterprise security suites.

What you can do

• Review the VoidAccess GitHub repository and read the self-hosting documentation thoroughly before deployment.
• Deploy the tool on a restricted network segment rather than exposing it directly to the public internet via a reverse proxy.
• Configure the setup wizard to generate strong, unique secrets for the database and API authentication.
• Test the Python command-line interface if your team prefers scriptable, terminal-based investigation workflows.
• Set up Ollama locally if you want AI assistance, ensuring you understand the resource requirements for running local models.
• Treat all generated AI explanations and graph connections as leads requiring manual verification, not definitive conclusions.