What the MLS Listing Doesn't Tell You: A Southern New Hampshire Case Study

Disclaimer. REFax™ is an automated property-intelligence and valuation analytics product. It is not an appraisal under USPAP and is not a substitute for a licensed appraiser, attorney, or tax advisor. Monadnock Cyber, LLC does not provide real estate brokerage, legal, tax, or appraisal services. The figures in this post are illustrative buyer education drawn from public records and our internal analytics; specific identifying details about the subject property, the seller, the listing brokerage, and prior tenants have been removed.

What the listing says

Last week a small downtown southern New Hampshire commercial property hit the market at $450,000. Two stories, mixed-use. Restaurant on the ground floor with a small apartment upstairs. The kind of building that looks like a “set-it-and-forget-it” income property — buy it, collect rent, sleep at night.

A buyer who only read the listing might see a recognizable restaurant brand, a downtown location, and a fair-looking asking price for a 2,800 sf mixed-use building. They might call the listing agent, schedule a walk-through, and start working on financing.

That buyer would be walking into a deal that does not work at any realistic financing terms, and they wouldn’t know it until the bank told them at the appraisal.

This is the gap REFax™ was built to close.

Five questions the listing won’t answer

Before we get to numbers, here are the five questions a serious buyer should be asking on any small downtown commercial property. None of them are answered by the MLS sheet, by Zillow, or by a 30-minute walk-through with the seller’s representative standing next to them:

1. Does the kitchen meet current code, or does a new concept trigger expensive hood, fire suppression, grease trap, or electrical upgrades?
2. Is the rent the most recent operator was paying realistic for the foot traffic this address actually generates?
3. Has anything changed in the surrounding block that pulled traffic away from breakfast/lunch positioning — a closure, a competitor opening, a parking change, a one-way street conversion?
4. Are there code or ADA exposures that would carry over to a new tenant under a change-of-use permit?
5. What did the most recent operator know in their last six months that isn’t in any public document?

A buyer who doesn’t ask these will pay full price for problems the next operator already discovered.

What two hours of public-records work surfaced

Here is what showed up when we ran our standard REFax™ commercial intelligence pull on this property.

Short hold, large markup

The seller acquired the building in June 2025 for $270,000. They listed it nine months later at $450,000 — a 67% markup, with no building permits or assessor improvements recorded in town records during the holding period. That alone isn’t proof of anything, but it is a question every buyer should be asking out loud: what changed in nine months that justifies a 67% revaluation?

The town’s own records don’t support the asking price

The 2025 town assessment is $249,500. Our REFax™ four-model commercial AVM, which combines income capitalization, comparable sales, cost approach, and gross rent multiplier, returned a value range of $298,000–$302,000. Two independent reference points — town assessor and a four-model AVM — converged in the high $200K range.

The asking price is $150,000 above the highest data-supported value either source produced.

The “established tenant” story needs scrutiny

The listing implies — without quite saying — that the building comes with a stable, established restaurant tenant. The reality, which a buyer would have to dig out of secondhand local knowledge: the ground floor is currently vacant. The brand the listing photographs imply is no longer operating at this address. This is the kind of fact that changes the entire underwriting model and is exactly the kind of fact that does not appear in MLS data, in Zillow, or in Redfin.

The math once you have the facts

Once you know the ground floor is vacant, the income approach to valuation produces a negative number. The apartment, even at full occupancy, doesn’t cover the building’s carrying costs (property tax, insurance, heat to keep the vacant restaurant from freezing in winter, water/sewer, management). Whoever holds it is losing money every month.

That changes the underwriting from “what cap rate makes this a good buy” to “what discount to vacant-condition value justifies the optionality of fixing it later.”

The data-supported value range for this property — what the AVM, the income model, and the assessor all converge on — sits between $195,000 and $245,000 in current condition. The asking price is roughly double the floor of that range. None of those numbers are an appraisal, and none of them are advice to bid; they are buyer education so the reader can see the size of the gap.

What the listing agent’s job is, and what it isn’t

The listing agent works for the seller. That is their job. Their fiduciary duty runs to the seller. They are paid to present the property in the best light, attract the highest offer, and close the deal. None of that is nefarious. It is the entire point of the listing-agent role under standard real estate brokerage law.

What the listing agent is not paid to do is tell a prospective buyer:

• That the seller acquired the building nine months ago for 60% less than the asking
• That the income side of the model in current state is zero
• That a four-model AVM independent of the listing produces a value 33% below asking
• That the property is unbankable at the asking price under any reasonable financing terms

A buyer who walks into a commercial deal with no independent intelligence is bringing a slingshot to a tank fight. The seller knows everything. The listing agent knows almost everything. The buyer knows what’s on the listing sheet and what they can read from a 30-minute walk-through.

That asymmetry is the entire reason independent intelligence exists.

What a REFax™ report contains

For every commercial property we touch, our standard pull includes:

1. Full assessor card — every field, every sub-area, every line of the valuation history, every owner of record back to the 1980s
2. Title chain reconstruction — every recorded deed, sale price, and instrument type, from the most recent transfer back to the 1980s
3. REFax™ four-model AVM — income cap, comp PSF, cost approach, and gross rent multiplier, combined into a single confidence-rated value with a range and a color signal
4. Distress signal feed — a continuously-updated WSPRS layer that flags foreclosure activity, expired listings, code violations, lien filings, SBA defaults, and other indicators of seller motivation that don’t show up in MLS data
5. Tenant-continuity research — for income properties, the public record of who has operated the business, for how long, and the current operating status
6. Sub-area analysis — for every commercial parcel, an itemized breakdown of finished vs. unfinished space, hidden equity, and under-assessed improvements (we have flagged a meaningful share of parcels in some New England towns as carrying significant finished area at zero living-area value)
7. Buy-side and list-side reference ranges, supported by a full cap-rate matrix and DSCR sensitivity analysis at multiple LTV scenarios — for buyer education only, not as an appraisal opinion and not as a recommendation to transact

None of this is exotic. It is what every institutional commercial acquirer does on every deal as a matter of standard practice. The only unusual thing about REFax™ is that we do it for small downtown New England commercial buildings under $1M — a price band that institutional buyers typically ignore and that local market data tools typically under-serve.

How to use this

Demand a REFax™ report on any commercial property you’re seriously considering. If you’re working with a buyer’s agent, ask whether they pull this kind of data on every deal — and if not, ask them to pull a REFax™ report on yours. A single-property report is $39.99. Unlimited access for active buyers is $149/month at refax.pro/subscribe.

The bottom line

The property in this case study will probably end up trading somewhere in the low-to-mid $200s. The seller will take a loss on their nine-month hold. A buyer who pays anything north of $245,000 for it without doing the work we did is overpaying by a margin that exceeds the cost of every REFax™ subscription tier we offer for the next decade.

That math isn’t unique to this property. We see the same pattern on every other small-commercial deal we touch. The information asymmetry between the listing side and the uninformed buy side is the single biggest drag on small-commercial returns in this market. Closing that gap is what REFax™ does.

If you are looking at a commercial property in southern New Hampshire and want to know what the listing isn’t telling you, pull a REFax™ report before you sign anything.

---

Jeffery Stutzman Monadnock Cyber, LLC — REFax™ / refax.pro jstutzman@monadnockcyber.ai refax.pro/subscribe

Monadnock Cyber, LLC is a property-intelligence and analytics company. It is not a real estate brokerage and does not offer brokerage, legal, tax, or appraisal services. REFax™ outputs are decision-support analytics for buyer education only and are not an appraisal under USPAP.

887,217 Properties. Here's What Stands Out.

887,217 Properties. Here's What Stands Out.

This week's scan covered 887,217 properties across New Hampshire. 3,041 came back undervalued. 14,410 overpriced. Confidence: 88%.

The opportunities worth watching:

• Hudson (Shadowbrook Drive) — AVM: $500K vs $435K asking. 95% confidence. Four methods agree.
• Goffstown (Libbey Street) — AVM: $428K vs $372K asking. 95% confidence.
• Barnstead (North Road) — $345K AVM vs $300K asking. 95% confidence.
• Merrimack (Maple Ridge) — $419K vs $365K asking. 95% confidence.

On the overpriced side: 14,410 properties where the data says the asking price doesn't hold up. If you're a buyer, that's negotiation leverage. If you're a seller wondering why the phone isn't ringing — the answer might be here.

The full Stutzman Report — every address, every signal — goes to subscribers every Monday. Get full access →

---

Jeff Stutzman is a former intelligence officer and the founder of Monadnock Cyber. REFax™ gives buyers, sellers, and agents the information advantage.

Know More. Move Faster. — Monadnock Cyber, LLC

Saturday Brief — How to Kill a $2M Company in Four Characters

☕ SATURDAY INTELLIGENCE BRIEF

The Weekly "How Did That Even Happen?" File

HOW TO KILL A $2 MILLION COMPANY IN FOUR CHARACTERS

admin/admin.

That's it. That's the whole security strategy. A manufacturing firm — profitable, 30 employees, two good decades — got ransomwared last fall because their network storage device was still running the credentials that shipped in the box. Not a sophisticated zero-day. Not a nation-state actor. A bot. Scanning the internet. Looking for exactly this level of ambition.

The attackers encrypted everything in eleven minutes.

Backups? Same network. Of course. Why would you put backups somewhere inconvenient? That would require planning, and planning would require admitting you're a target, and admitting you're a target would require spending money, and spending money would require a conversation with the owner, and the owner was busy. For five years.

Cyber insurance? They'd dropped the rider to save $4,200 a year. Annual savings: $4,200. Annual consequences: $340,000 in recovery costs they couldn't afford, 30 people without jobs, and a building that's now listed with a business broker instead of an IT firm.

For context: $4,200 is roughly what this company spent on break room coffee. They valued Keurig pods more than data security. The attackers valued their data at $340,000. Someone miscalculated.

THE PART THAT SHOULD MAKE YOU UNCOMFORTABLE:

This isn't rare. This is the median outcome.

88% of SMB breaches last year involved ransomware. 65% of SMBs don't use multi-factor authentication — the thing that takes 45 seconds to set up and blocks 99.9% of automated attacks. Only 11% use any AI-powered defense. The average SMB has better protection on their Instagram account than their production database.

The attackers aren't talented. They're just patient. And they start every scan with admin/admin, because it works more often than it should.

IF YOU SELL CYBERSECURITY: This story isn't a scare tactic. It's a Tuesday. You have prospects right now running default credentials on internet-facing devices. We can tell you which ones.

IF YOU BROKER BUSINESSES: The next deal you value, ask one question — "who manages your network credentials?" If the answer is a shrug, discount accordingly.

IF YOU BUY BUSINESSES: "Has this company had a security audit in the last two years?" is the new "are the books clean?" If they can't answer both, walk.

Have a good weekend. For the love of everything, change your passwords.

— Monadnock Cyber | Intelligence & Analysis

monadnockcyber.ai

#SaturdayBrief #CyberIntelligence #DontBeThisCompany

Saturday Intelligence Brief: How a $2M Business Died Because Nobody Changed the Default Password

☕ SATURDAY INTELLIGENCE BRIEF

The Weekly "How Did That Even Happen?" File

HOW A $2M BUSINESS DIED BECAUSE NOBODY CHANGED THE DEFAULT PASSWORD

A manufacturing firm in the Northeast — profitable, 30 employees, two decades in business — got hit with ransomware last fall. The entry point? Their network-attached storage device still had the factory login: admin/admin.

Not admin/P@ssw0rd123. Not admin/companyname2024. Just admin/admin. The same credentials printed on page 3 of the setup guide that nobody read in 2019.

The attackers encrypted everything. Backups? On the same network. Insurance? They'd let the cyber rider lapse to save $4,200 a year. Recovery estimate? $340,000. The owner looked at the numbers, looked at the building, and called a business broker instead of an IT firm.

Thirty employees found out on a Monday.

LESSON FOR THE INTELLIGENCE COMMUNITY

Every business that fails this way had the same three things in common — they knew they should update their security, they planned to do it "next quarter," and they assumed they were too small to be a target.

They weren't too small. They were too easy.

88% of SMB breaches last year involved ransomware. 65% of SMBs still don't use multi-factor authentication. The attackers aren't sophisticated — they're just persistent, and they start with the default credentials.

If you sell cybersecurity services: this story is your opening line.
If you sell businesses: this is why you check the cyber liability exposure before you set the asking price.
If you buy businesses: this is the due diligence question nobody asks until it's the only question that matters.

"When was the last time someone audited your network credentials?"

If the answer involves a pause longer than three seconds, you have your next conversation.

Have a good weekend. Change your passwords.

— Monadnock Cyber | Intelligence & Analysis
monadnockcyber.ai

Property Intelligence Brief — You Don't Need a Data Science Team. You Need a REFax.

REFaxProperty Intelligence Reports — refax.pro

Intelligence Brief — March 2026

You Don't Need a Data Science Team.
You Need a REFax.

The industry keeps publishing deep dives on how to integrate MLS, AVM, and parcel data. Nobody's asking the obvious question: why is this still the buyer's problem?

By Jeff Stutzman — Founder, REFax5 min readReal Estate Intelligence

The Warren Group recently published a thoughtful piece on how proptech platforms can integrate MLS, AVM, and land parcel data to produce better property intelligence. It's technically sound. It's also a recipe for a six-figure engineering project. REFax did that work already.

Let's give credit where it's due. The Warren Group knows real estate data. Their breakdown of how Automated Valuation Models, active listing feeds, and parcel boundary data each contribute a different lens to property analysis is accurate and well-explained. AVM data models the math. MLS data delivers the market pulse. Parcel data anchors everything in geography and legal reality. Combine them intelligently, and you get something that actually resembles truth.

But here's what the enterprise proptech conversation consistently misses: most real estate decisions aren't made by data scientists at mortgage portfolio firms. They're made by buyers sitting at kitchen tables at 11pm, by agents trying to answer hard questions on the spot, by investors who need a clear-eyed read on a property before the listing goes cold. These people don't have an API integration budget. They don't have a data normalization pipeline. They have a question and a deadline.

The data integration problem is real. REFax solved it on behalf of everyone who doesn't have a team to solve it themselves.

What "integration" actually requires

The Warren Group is right that combining these datasets isn't trivial. Here's what's actually involved when you try to build it from scratch:

The proptech data stack — raw ingredients

AVM DataStatistical model estimates against historical sales records, assessor data, and market indicators. Useful but confidence intervals vary wildly by market density. Thin rural markets produce wide error bands.

MLS DataActive, pending, and sold listing details including agent notes, days-on-market, price history, and photos. Requires IDX/RETS/RESO Web API access — gated by board membership and licensing agreements.

Parcel DataGIS-anchored legal boundaries, lot dimensions, zoning classification, and assessor tax records. Format varies by county. Normalization is a recurring engineering problem.

Deed & MortgageOwnership chain, lien history, and transaction records. Critical for understanding encumbrances, equity position, and distress signals.

Permit HistoryBuilding permits signal improvement activity, unpermitted work risk, and contractor history. Sourced from municipal records with inconsistent digitization across jurisdictions.

Now stitch all of that together, normalize it, deduplicate it across sources that use different address formats, and present it in a way a non-data-scientist can act on. That's the problem the Warren Group is describing. That's the problem REFax solved.

REFax is the assembled report, not the raw data

REFax is a property intelligence report platform. When you run a report on a property at refax.pro, you're not getting a data dump. You're getting a structured intelligence product — the kind of synthesized, source-attributed analysis that used to require a team of analysts or a six-figure proptech subscription.

The data integration that the Warren Group describes as a technical challenge? That's the foundation of every REFax report. MLS activity, AVM estimates with confidence context, parcel and assessor data, ownership history, lien records — integrated, normalized, and presented in plain language with the sourcing transparent.

The difference between REFax and raw data access isn't just convenience. It's interpretation. A parcel record that shows a property is zoned R-3 is a data point. A REFax that explains what that means for a buyer considering an ADU addition — and flags the relevant permit history — is intelligence. Data tells you what. REFax tells you what it means.

Data tells you what. REFax tells you what it means.

Who this is actually for

The enterprise proptech stack the Warren Group describes has its place. Portfolio managers, institutional lenders, and insurance underwriters need bulk data pipelines, API access, and batch valuation capability. REFax is not competing with that. REFax competes with the yellow legal pad and the thirty-minute Zillow deep-dive that passes for due diligence in most residential transactions.

Real estate agents use REFax to walk into listing appointments with something no competitor has: a fully sourced property intelligence brief they can hand the seller. It's not a CMA. It's not a Zestimate printout. It's an analyst-grade report that demonstrates competence before the conversation starts.

Buyers use REFax to make decisions they can actually justify — to their spouse, their lender, their own risk tolerance. When you're about to commit to the largest purchase of your life, "I looked at Zillow and it seemed fine" is not a foundation. A REFax is.

Investors use REFax to move faster. The property data integration problem is a time problem. Every hour spent assembling your own AVM cross-reference and parcel analysis is an hour the deal can die. REFax compresses that timeline to minutes.

The honest assessment

The Warren Group article is aimed at engineering teams building proptech platforms. That's a legitimate market. But the real estate transaction — the actual human decision about whether to buy a specific house — happens below that layer, in conversations that are rarely informed by good data.

REFax is the answer to that gap. Not a better data API. Not a smarter AVM. A finished intelligence product that makes the data useful at the moment the decision is being made.

The integration problem is real. We just solved it on behalf of the people who can't.

---

Run your first REFax report.

Property intelligence on any address — assembled, sourced, and ready in minutes. No data science required.

Get a REFax →

REFax™ is a registered trademark of Monadnock Cyber LLC. — refax.pro

This post was written in response to "How to Integrate MLS, AVM, and Land Parcel Data in Your PropTech Platform" — The Warren Group, March 2026.

Zillow Preview Just Launched. Here's Why eXp Agents Are Already Ahead.

Zillow Preview Just Launched. Here's Why eXp Agents Are Already Ahead. 
March 17, 2026 | Jeff Stutzman, Monadnock Cyber Realty | eXp Realty NH

---

Today, Zillow announced Zillow Preview — a pre-market listing phase that lets agents display upcoming homes on Zillow and Trulia before they hit the MLS. Keller Williams, RE/MAX, HomeServices of America, United Real Estate, and Side signed on as founding partners.

This is a big move. And it's worth understanding what it means — and what it doesn't mean — for those of us at eXp.

What Zillow Preview Does

• Agents at participating brokerages can post "Preview Listings" before MLS entry
• Buyers see these listings with special placement and labeling
• Buyers can save, share, and pre-schedule tours for go-live day
• Free leads go directly to the listing agent (no Zillow lead fee)
• If a Preview lead closes with a different Zillow partner agent, the listing agent gets a 10% referral from the buyer side

What This Really Is

Zillow Preview is a billboard. It gives agents a place to display a listing early. That's valuable — 230 million monthly visitors is no joke.

But a billboard only works if you already have the listing.

The harder question — the one Zillow Preview doesn't answer — is: How do you find the seller in the first place?

What We're Building at Monadnock Cyber

While the big brokerages are figuring out where to display listings, we've been building the system that identifies sellers before they know they're selling.

Our platform scans 92 independent sources nationwide every morning — public records, government registries, verified commercial data, and proprietary market models — and runs them through an AI-driven analysis engine. The output:

• 828,000+ properties valued across a 4-method automated valuation model
• Underpriced and overpriced properties flagged daily — GREEN (opportunity), RED (overpriced), YELLOW (fair value)
• Distress signals detected automatically — tax liens, probate, divorce, relocation, code violations, estate sales
• Owner contact enrichment — verified through government registry data and enhanced contact verification
• DNC compliance built in — every phone checked against federal Do Not Call before any outreach

This isn't a listing tool. It's an intelligence platform. By the time a property shows up on Zillow Preview, we've already identified the owner, assessed the property's true value against multiple independent methods, and — in many cases — started the conversation.

The eXp Advantage

eXp wasn't named as a founding partner for Zillow Preview. Some agents may see that as a disadvantage. I see it differently.

We don't need Zillow to find our deals. We find them ourselves — earlier, with more data, and with full context on the owner's situation. If the listing eventually goes on Zillow Preview through a partner brokerage? Fine. But our agents already had the intelligence weeks before it got there.

The real competition in real estate isn't about who has the best billboard. It's about who has the best radar.

What This Means For You

If you're an eXp agent and you want access to:

• The Stutzman Report — Monday morning intelligence briefing covering the top underpriced and overpriced properties in your market
• Pre-market seller identification — distress signals, propensity scoring, and owner profiles before the property ever hits MLS
• Verified owner contact data — DNC-compliant, multi-source validated
• AI-driven market analysis — automated valuation on 828K+ properties across multiple states

Reach out. We're building this for eXp agents who want to operate with better intelligence than anyone else in their market.

Jeff Stutzman Monadnock Cyber, LLC | eXp Realty jstutzman@monadnockcyber.ai | (603) 930-2222 https://refax.pro

---

Monadnock Cyber is a real estate intelligence operation built on automated collection, AI-driven analysis, and multi-source validation. We don't scrape. We don't guess. We verify. Information is derived from public records, verified commercial sources, and proprietary intelligence models.

Stop Overpaying for Real Estate. We're Watching.

Stop Overpaying for Real Estate. We're Watching.

By Jeff Stutzman | Monadnock Cyber Intelligence | February 2026

You just paid $1.75 million for a house in XXXXXX, Connecticut.

Congratulations. It's worth $1.22 million.

You overpaid by 43.5%. That's $530,000 you lit on fire because your agent "felt good about the comps" and your lender rubber-stamped a number that made their commission work.

Nobody told you. Nobody was looking. Nobody cared — because everyone in that transaction got paid whether you got a fair deal or not.

We care. And we're looking at everything.

---

We Built the Machine That Catches This

At Monadnock Cyber, we don't sell houses. We sell intelligence.

While the rest of the real estate industry is still pulling comps from a 3-ring binder and calling it "market analysis," we built an automated valuation system that cross-references four independent pricing methodologies on every property we track:

• Method A — MLS comparable sales analysis (what similar properties actually sold for)
• Method B — Municipal assessment data, adjusted by state equalization ratios (what the town thinks it's worth, corrected for political math)
• Method C — Skip trace equity modeling (what the financial footprint says)
• Method D — Transfer price indexing (what the deed actually recorded)

When those four numbers agree, we have high confidence. When they don't, someone's getting taken for a ride.

We color-code every property:

• GREEN — Underpriced. The seller left money on the table. The buyer got a deal.
• YELLOW — Fair value. Both sides can sleep at night.
• RED — Overpriced. Someone paid too much. Period.
• GREY — Insufficient data. We don't guess.

---

The Numbers Don't Lie. People Do.

Right now, we're actively tracking 38,967 property valuations across 15 states and DC, fed by 1.67 million distress signals from 33 independent data sources. This isn't a weekend hobby. This is an intelligence operation.

Here's what we found in just the last seven days:

671

Properties Overpriced

RED — in 7 days

$942M

Collectively Overpaid

One week of data

That's not a typo. Nearly a billion dollars in unnecessary cost — in seven days — just in the properties we've valued so far. Imagine what a full year looks like.

That's one week. One. The machine never stops collecting.

Wall of Shame

Location	Paid	Actually Worth	Overpaid By
XXXXXX, NH	$1,675,000	$1,266,783	32.2%
XXXXXX, CT	$1,860,000	$1,387,638	34.0%
XXXXXX, CT	$1,750,000	$1,219,529	43.5%
XXXXXX, CT	$1,650,000	$1,120,786	47.2%
XXXXXX, WV	$27,200,000	$18,732,363	45.2%

That NH property? Lakefront New Hampshire. Beautiful area. Terrible deal. Someone paid $408,000 more than they should have because nobody in the room had independent valuation data.

---

This Isn't Just New Hampshire

We started in the Lakes Region. Now we're everywhere that matters.

PennsylvaniaConnecticutNew YorkMarylandVirginiaNorth CarolinaArizonaWest VirginiaWashington, DCVermontColoradoMaineMassachusettsNew Hampshire

You think Manhattan commercial real estate is priced rationally? We found a "luxury hotel" property in  valued at $111 million that traded at $260 million. That's a 134% premium. Somebody's CFO should be asking questions (OR FIRED!).

This is what happens when buyers rely on the same people selling the deal to also validate the deal.
It's the fox guarding the henhouse, and the fox is wearing a blazer.

---

How We're Different

Traditional real estate runs on three things: gut instinct, motivated reasoning, and information asymmetry. The agent knows more than you. The seller knows more than you. The lender just wants to close.

We flip that model. Our system:

• Runs 24/7. Automated collectors pull data from public records, MLS feeds, municipal assessments, and federal registries while you sleep.
• Uses four independent valuation methods — not one, and not the Zestimate. All four must converge before we call a property fairly priced.
• Covers 158 million+ U.S. properties. That's 99% of the U.S. population's real estate footprint.
• Flags overpriced deals in real time. Before you wire the money. Before the ink dries.
• Has no commission bias. We don't get paid more when you pay more. Novel concept in this industry.

---

The Intelligence Advantage

Here's what the billion-dollar Wall Street firms already know: real estate is an information game. The party with the best data wins. Blackstone doesn't buy a strip mall because the listing agent said it's a "great opportunity." They run the numbers. Multiple numbers. From multiple sources.

You deserve the same advantage.

We call it REFAX — Real Estate Financial Analysis, Cross-Referenced. Every property gets a color. Every color is backed by math. Every decision you make is informed by data, not by someone who gets 3% of whatever you pay.

---

What This Means for You

If you're buying: You should know the real value before you bid. Not the listing price. Not the "estimated market value" your agent pulled from a single source. The actual, multi-method, cross-referenced value.

If you're selling: You should know exactly where your property sits. GREEN means you're priced to sell fast. RED means your agent priced it to maximize their commission, not your outcome. YELLOW means you're in the zone.

If you're investing: You should be looking at our GREEN list. Properties where the math says there's value the market hasn't priced in yet. That's not speculation — that's arbitrage.

---

We're Not Done

Residential. Commercial. Land. We value all of it. And we're moving quickly into business brokering and M&A — because the same information asymmetry that lets someone overpay for a lakehouse also lets someone overpay for a company.

38,967 valuations is the starting point. We're expanding coverage weekly. More states. More property types. More asset classes. The goal is simple: make information asymmetry a thing of the past.

The industry won't like it. They never do when someone turns the lights on.

But here's the thing — we're not asking permission.

Jeff Stutzman is the founder of Monadnock Cyber Intelligence and Monadnock Cyber (NH). He spent 35+ years in intelligence and cybersecurity before deciding the real estate industry needed the same treatment. He was right.

Have a property you want valued? Think you overpaid? Contact us — we'll tell you the truth, even if your agent won't, even if you don't like it.

Monadnock Cyber | New Hampshire

Intelligence-Driven Real Estate

Superhuman Intelligence: How Beadwindow Delivers Hours of SOC Analysis in Milliseconds

Seven analytical engines, all firing in parallel, all showing their work -- and the SOC analyst walks into a finished intelligence product instead of a raw data dump. The Machine is doing more analytical work in 200ms than most commercial SIEMs do in their entire investigation workflow. That's what Superhuman Intelligence is all about.

The Problem Every SOC Analyst Knows

You're staring at an alert. "AI Detection: Port Scanning -- HIGH." The badge is red. The IP is 192.168.1.1. Now what?

If you're a human analyst, the next 45 minutes look something like this:

1. Open a terminal. Run whois 192.168.1.1. Realize it's RFC-1918. Close the terminal.

2. Check the DHCP table. Figure out it's the gateway.

3. Open Wireshark. Filter by IP. Wait for it to load. Scroll through 6,000 flows.

4. Notice 24 unique destination ports. Manually count them.

5. Open the MITRE ATT&CK Navigator. Search for T1046. Read the technique description.

6. Check if this IP has been seen before. Query the SIEM. Wait. Scroll. Count.

7. Check the firewall logs. Did Firewalla see this? Did the ASA block it?

8. Check if any external IPs were involved. Parse through NAT translations.

9. Correlate timestamps. Build a timeline. Write it up.

10. Brief your team lead.

That's an hour of work. Per alert. And you have 800 more in the queue.-----What If the Machine Did All of That -- On Every Alert -- Before You Even Clicked?

That's what Beadwindow v12 does. When you click into an alert investigation page, seven analytical engines fire simultaneously. By the time the page renders -- roughly 200 milliseconds later -- you're looking at the finished intelligence product.

Not raw data. Not a log dump. A synthesized assessment with reasoning.

Here's what the system produces for that same port scanning alert, automatically:Neural Analysis

Anomaly Score: 0.85

Models Used: mranv/siem-llama-3.1:v1 (Fred, SIEM Analyst)

Threat Indicators:

 - 20 ports scanned from single source [HIGH]

   "Horizontal port scanning indicates network reconnaissance"

 - 1 unique target host [LOW]

   "Single target -- could be targeted attack or service probe"

 - MITRE ATT&CK: T1046 (Network Service Discovery) [HIGH]

   "Behavioral pattern matches known adversary technique"

 - Detection confidence: 40% [MEDIUM]

   "Confidence derived from behavioral pattern matching against known attack signatures"

 - Source: 192.168.1.1 [INFO]

   "Originating IP captured from SPAN port mirror on USW-Pro-48"

Every indicator comes with a reason. Not just "what" -- why.

AI Assessment with Full Reasoning Chain"Detection engine identified Port Scanning originating from 192.168.1.1. Mapped to MITRE ATT&CK T1046 (Network Service Discovery) -- this technique is used by adversaries to enumerate network services and identify exploitable entry points. Observable evidence: 20 ports probed, 1 target host. Fred (SIEM Analyst, siem-llama-3.1) scored 85/100: HIGH confidence threat requiring immediate SOC attention. Ethel (Risk Analyst) has not yet validated this finding -- single-model assessment only. FLAGGED: Queued for manual SOC analyst review and triage."

This isn't a template. It's generated dynamically from the actual evidence, AI scores, MITRE mapping, and verdict state of each individual alert. Different alert? Different narrative. Every time.Network Evidence: PCAP-Level Pattern Analysis

The system pulls 50 related network flows and analyzes them for patterns:

PORT SCAN: 24 unique destination ports contacted --

 indicates systematic service enumeration

MULTI-TARGET: traffic to 9 distinct hosts --

 suggests automated scanning or lateral movement

Protocol breakdown: UDP: 29 flows, TCP: 21 flows

Data volume: 51.9 KB transferred (51.9 KB out, 0.0 KB in)

That asymmetric traffic pattern (51.9 KB out, 0.0 KB in) tells its own story -- outbound probing with no responses. Classic reconnaissance.Source Intelligence: Who Is This IP?

This is where it gets interesting. The system doesn't just tell you the IP address. It tells you who it is:

192.168.1.1

 [RFC-1918 Internal] [Ubiquiti USG/Gateway] [gateway]

 Reverse DNS: unifi.localdomain

 Behavior: High port and destination diversity -- consistent with

   NAT gateway or router (6,037 outbound flows, 6,805 inbound,

   4,711 unique dest ports)

 Alert History: 800 alerts (Port Scanning: 600, Reconnaissance: 200)

   First seen: 2026-02-10 | Last seen: 2026-02-11

For an internal IP, the system automatically traces external contacts -- who was this host talking to outside the network in the 30-minute window around the alert? It enriches each external contact with reverse DNS, Firewalla GeoIP data, and cross-references against the alert database.

For an external IP like 160.79.104.10 (150 alerts on file), the intelligence is even more pointed:

160.79.104.10

 [Public Internet] [scanner]

 Reverse DNS: none (hiding behind privacy/CDN)

 Behavior: Elevated port diversity suggests scanning or enumeration

 Targeted internal hosts: 192.168.1.102 (Mac Mini M4 SIEM) -- 132 flows

An external IP with no reverse DNS, scanner behavior, and 132 flows aimed directly at our SIEM server. That's actionable intelligence. That's a candidate for an abuse notification to the ISP. That's a future SWARM escalation target. IOC Cross-Referencing..

Every alert is automatically correlated against:

• The alert corpus: "This IP has appeared in 800 total alerts"

• Block actions: "IP was blocked via auto-response on 2026-02-10"

• Firewall logs: "Firewall observed 47 flows, actions: allow. GeoIP: US"

• Behavioral indicators: "20 ports scanned targeting 1 host -- moderate intensity"

Full Event Timeline

Not just "alert created." A complete chain of custody:

1. SPAN Capture: "SPAN port (en11) captured suspicious traffic from 192.168.1.1 via USW-Pro-48 port mirror"

2. Detection: "Alert generated: AI Detection: Port Scanning"

3. Fred Analysis: "Fred (AI SIEM Analyst) completed analysis -- threat score: 85/100. HIGH confidence: attack pattern matches known signatures."

4. AI Verdict: "Flagged for MANUAL REVIEW -- analyst must confirm or dismiss."

If a block action was taken, it's in the timeline. If an audit log entry exists, it's there. The full story, chronologically, with severity ratings on every event.-----The Philosophy: Show Your Work

Here's the thing about AI in security operations. The industry has spent years building black boxes. "Trust the score." "It's AI." "The algorithm detected it."

That's not good enough for a SOC.

When a human analyst investigates an alert, they build a mental model. They trace connections. They form hypotheses. They document their reasoning. And when they brief their team lead, they don't say "the score was 85." They say why.

Beadwindow v12 does the same thing. Every score has a reason. Every indicator has context. Every assessment has a narrative. The AI doesn't just detect -- it explains.

This isn't about replacing analysts. It's about giving them the finished product so they can make decisions instead of doing data entry.

The difference between a Level 1 analyst and a Level 3 analyst isn't knowledge -- it's speed. A Level 3 knows what to look for and where to find it. Beadwindow gives every analyst Level 3 speed on every alert, from their first day.-----The Numbers

Task	Human Analyst	Beadwindow v12
Identify source IP role	5-10 min	Instant
Reverse DNS + GeoIP	2-5 min	2 seconds
MITRE technique mapping	5-10 min	Instant
Network flow analysis	15-30 min	Instant
IOC cross-referencing	10-20 min	Instant
External contact tracing	15-30 min	Instant
Build investigation timeline	10-15 min	Instant
Write assessment narrative	10-15 min	Instant
Total	~90 minutes	~200 ms

That's not an optimization. That's a paradigm shift.-----What's Next?

This is the foundation. The source intelligence pipeline is ready for:

• Abuse notifications: Automated emails to ISP abuse contacts for US-based providers hosting scanners

• SWARM escalation: AI-coordinated multi-model threat hunting and defense on high-confidence alerts --2ndAmendmentCyber.

• Temporal analysis: "This IP scans us every Tuesday at 3 AM" -- pattern-of-life detection

• Reputation scoring: Aggregated threat scores that improve over time as the corpus grows

The alert investigation page isn't just a viewer anymore. It's the SOC analyst's co-pilot.-----Beadwindow is an on-premise SIEM/XDR platform built on FastAPI, running on Apple Silicon, with dual-AI analysis (Fred + Ethel), SPAN port capture, and synthesized intelligence that shows its work. Every alert. Every time.

By Jeffery Stutzman, Beadwindow Project, https://2ndAmendmentCyber.com

"F**KIN A"