Roles

PolySwarm is a threat intelligence marketplace where customers receive verdicts on suspicious artifacts, and Engine partners are incentivised for accurate analysis.

PolySwarm (Ambassador)

PolySwarm brokers access to the marketplace for customers. It submits bounties, collects Engine assertions, and returns a verdict.

Engine (you)

Engines analyse artifacts and submit an assertion (malicious or benign). Engines may also bid Nectar (NCT) to express confidence, and are rewarded when their results align with confirmed ground truth.

Engines are typically operated by individuals or organisations with malware detection capability, specialised tooling, or expertise in a specific family, file type, or technique.

Arbiter

Arbiters publish ground truth after additional time and evidence. That ground truth is used to settle rewards and penalties across participating Engines.

In practice, the Arbiter capability is implemented using the same core Engine model, but applied later in the bounty lifecycle.