The first suspect is often the spreadsheet. It holds the calls, addresses, payments and names, each obediently sitting in its own cell. What it does not readily show is the shape of the case: the phone shared by two people, the address reused across claims, the quiet broker who sits between clusters. i2 Group built its name by giving investigators a canvas for those relationships. Its flagship, Analyst's Notebook, converts a pile of records into entities and links that can be arranged, questioned and explained.
This sounds ordinary now that every software pitch contains a knowledge graph. It was not ordinary in Cambridge in 1990, when former intelligence analysts Mike Hunter and Dr Tim Spiers founded i2. Investigative work was heavy with paper and manual profiling. Their practical bet was that a computer should help an analyst see, without pretending to be the analyst. People, vehicles, accounts, incidents and places became symbols. Connections became lines. Time and geography could share the same field of view.
“We can now take seemingly unconnected data points and present them as a clear, coherent picture of organised fraud.”Ben FitzHugh, Head of Intelligence, Keoghs
The chart is not the answer. It is the argument.
That distinction explains why the product travels well across professions. A police analyst can map calls around a robbery. A bank can connect accounts, devices and beneficiaries. A retailer can trace identity theft across stores. A defense team can combine reports, sensor data, locations and supply chains. The objects change; the analytical grammar does not.
In Dallas, the Scarecrow Bandits investigation began with records from several phone providers being sorted in Excel. Police had perhaps 100 possible links around 21 bank robberies. After loading the data into Analyst's Notebook, the team eliminated irrelevant calls and narrowed the pattern to fewer than 10 phones appearing near robbery locations. Wiretaps and police work did the rest. The charts later helped explain the relationships at trial; seven defendants received sentences totaling 2,945 years.
The lesson worth copying is less cinematic. Start with a bounded case, import the evidence already available, agree on the meaning of each entity and link, then make the first useful chart quickly. The software earns its place when that chart changes a question, a priority or a decision. Buying an enterprise repository before investigators have a shared data model merely creates a more expensive cupboard.
A workbench grew into a secure assembly line
Analyst's Notebook remains the recognizable front end, but i2 now sells a stack. iBase stores structured investigative material for teams. Analysis Studio adds shared charts, a browser client and searches across connected sources. Analysis Hub is the larger enterprise arrangement, with centralized controls, a scalable repository, alerts and collaboration. Buyers can begin with perpetual desktop licensing or an annual subscription, then add server products, connectors, implementation, support and training. Public list prices are not posted; the buying journey runs through a demo and quote.
The newer add-ons attack the expensive parts of the intelligence cycle. TextChart extracts people, crimes, dates, locations and relationships from documents in more than 200 languages. Insights automates common imports and patterns of life. Explore gives non-analysts a simpler browser experience. Overwatch extends the map and timeline for defense planning. Connectors reach outside data providers or internal systems, while professional services handle the stubborn integration work.
This is also where i2's AI position is more grounded than its vocabulary sometimes suggests. An agency can import flat-file results from its own models, connect an external large language model through an API, or build a web-client plug-in that summarizes a graph. The output returns to the same inspectable workspace. In intelligence, a fluent answer with an uncertain origin is not a shortcut. It is a fresh investigative problem.
The customer who changed its mind in a month
The Foschini Group, a South African retailer with thousands of outlets and a consumer-credit business, offers the cleanest account of adoption. Its first failure was the reactive, one-case-at-a-time approach. Fraud moved across brands, stores and identities; staff collusion made the pattern harder to spot. The company began a proof of concept with a new-accounts manager and two analysts using iBase and Analyst's Notebook.
Within the first month, the team found a syndicated fraud pattern and evidence of staff collusion. Police and area managers acted within 24 hours at one jewelry store. The proof of concept became a daily intelligence operation: new records enriched iBase, visual links fed internal high-risk lists, and the business moved upstream from investigating approved fraud to blocking suspicious applications. What changed minds was not a transformation workshop. It was an actionable find.
At UK law firm Keoghs, the problem was again fragmentation: spreadsheets, Access databases and isolated queries. Its 35-person intelligence team built a unified environment around iBase and Analyst's Notebook. In one matter, links emerged across 33 incidents involving a retailer's delivery fleet, producing an outcome worth about £300,000. The value was both detection and communication. A chart could move from analyst to lawyer to courtroom without turning the network back into a paragraph.
Four owners, one stubborn visual language
Enterprise software often disappears into the company that buys it. i2 has been passed around without being dissolved. ChoicePoint acquired it in 2005 for a net purchase price of about $96 million. Silver Lake Sumeru paid $185 million in cash three years later. IBM bought the company in 2011 for an undisclosed sum and placed it in the Smarter Cities portfolio. In January 2022, Harris Computer acquired the products and staff, again without publishing the price, and made i2 an autonomous business unit.
Known acquisition prices, USD millions
Harris's vertical-market software model suits a product whose customers keep systems for years. Since the split from IBM, i2 has refreshed packaging, brought specialist training back in-house through a 2024 agreement with Shortest Path, and added adjacent businesses in protective monitoring, professional-standards case management and major-case management. The company reported 18 percent annual software-license growth in 2024, then a 40 percent year-on-year increase in bookings for fiscal 2025.
The moat is tradecraft, not magic
i2 sits between general graph visualization and full intelligence platforms. Palantir and Quantexa compete for large data-fusion programs. Maltego and Linkurious offer graph-oriented investigation and visualization. SAS and NICE Actimize are established financial-crime alternatives. Plenty of teams still assemble their own stack from spreadsheets, GIS, databases and case-management tools.
i2's difference is accumulated workflow: import specifications, entity-link-property modeling, chart conventions, security controls, connectors, trained users and a partner network built around investigative practice. Analyst's Notebook is a specialist instrument. That brings depth, but it also means outcomes depend on disciplined data preparation, permissions, training and governance. It will not rescue missing evidence, reconcile every duplicate automatically or make an untested AI result trustworthy. Small teams with clean, simple data may be better served by lighter graph tools. Organizations unwilling to maintain a data model will produce beautiful confusion.
Choose a case where fragmented records hide a real operational decision. Define the entities, preserve provenance, chart the first pattern with practitioners, and measure whether it changes time-to-insight or action. Scale the repository only after the workflow survives contact with users.
The newest move is i2 Amplify, a free community for active customers, designed to let analysts and investigators trade techniques between conferences and support calls. It is an admission that software alone is only half the product. A link chart becomes useful through shared practice: what counts as evidence, how confidence is marked, when two records should merge and how a conclusion can be challenged.
That may be why a product born before the commercial web has not become a museum piece. Crime, fraud and conflict changed their mediums, but they did not stop being networks. i2 kept the screen centered on the analyst's oldest obligation: connect the facts, then let someone else inspect the connection.