SpyCloud Investigations Module is a threat intelligence investigation platform that enables security analysts to investigate identity exposures and cybercrime activities using darknet data. The tool allows investigators to start with common data points such as email addresses, usernames, or phone numbers and pivot across SpyCloud's dataset of exposed assets to uncover identities, infrastructure, and connections. The platform incorporates IDLink analytics to automatically piece together holistic views of digital identities by revealing hidden connections and linkages across personal and professional identities. AI Insights functionality applies tradecraft expertise to transform scattered exposure data into finished intelligence reports, detecting suspicious patterns and surfacing attribution signals. The module provides interactive graphs and embedded analytics to visualize identity footprints of exposed employees, customers, vendors, and threat actors. It is designed for use by CTI teams, SOC analysts, identity teams, and fraud and risk teams to conduct investigations related to insider threats, fraud campaigns, account takeover prevention, and threat actor attribution. The tool requires no coding or setup and provides investigative workflows that automate the process of pinpointing identity exposures. According to user testimonials, the platform can reduce investigation time from hours to minutes by automating manual analysis tasks.