Cyware unveils Agentic AI Fabric for threat defence

Cyware has launched Agentic AI Fabric, a new set of agent-driven features that sits inside its threat intelligence platform and spans investigation, detection engineering, and incident response workflows.

The release centres on an Analyst Agent Hub and an agent catalogue. Cyware positions the approach as a way for security teams in enterprises, information sharing and analysis centres, and government organisations to apply automated agents within their existing threat intelligence processes.

Agent-led workflow

Agentic AI Fabric builds on the AI Fabric foundation Cyware introduced in late 2025. The new layer adds goal-driven agents that can plan and execute multi-step tasks using threat intelligence and related data stored in the platform.

Cyware frames the announcement against a broader shift in the threat landscape. Attackers have adopted AI to increase speed and scale in reconnaissance, social engineering, and malware development. Defensive security vendors have responded by adding automation and generative AI features to tools used by security operations teams.

Cyware said the update adds a "native Analyst function" to the platform, with agents acting as collaborative digital teammates that coordinate analysis and defensive actions.

Cyware Chief Product Officer Sachin Jade said the strategy focuses on threat-centric agentic AI.

"Cyware is aggressively advancing threat-centric Agentic AI for cyber defense to meet pent-up customer and industry demand. Agentic Fabric introduces an ecosystem of specialized agents that work alongside analysts, applying threat intelligence and correlated data and executing objectives across the entire security lifecycle. This approach empowers defenders to innovate at the pace of the adversaries they face," Jade said.

Analyst hub

The Analyst Agent Hub is positioned as the control point for these workflows. Cyware said it will be available in the platform and through a browser extension, allowing analysts to select and coordinate agents across different workstreams.

Agentic AI Fabric also introduces an agent catalogue, which Cyware said will expand over time and integrate across its product suite. Cyware listed several agents aimed at common security operations tasks, from providing context for analysts to generating detection content.

One example is an Attack Flow Agent, which Cyware said reconstructs adversary timelines and maps activity to the MITRE ATT&CK framework, a widely used structure for describing attacker behaviours. A Contextual Intelligence Agent summarises threat intelligence and converts raw data into plain language, according to the company.

For security operations centre work, an SOC Analysis Agent supports investigation and triage. It is designed to provide context behind alerts and explain why activity may represent a threat.

Detection content

Cyware also highlighted an agent aimed at detection engineering. The Detection Engineering Agent is described as helping analysts generate "Threat Detection Logic (TDL)" and write YARA and Sigma rules. YARA is commonly used to identify and classify malware based on patterns, while Sigma is a generic format for describing detection rules that can be converted into queries for different security tools.

The release follows a broader trend in security operations towards automation for routine analysis and content generation. Security teams face pressure to triage large volumes of alerts while maintaining coverage across a growing range of attacker techniques. Vendors have increasingly pitched AI features as a way to reduce manual enrichment and analysis while keeping people in decision-making roles for response actions.

Cyware said the platform will also support custom agent creation and deployment for specific customer requests. It described this capability as "Enhanced Customer Response," saying it would allow the company to create and deploy bespoke agents quickly for particular use cases.

Product lineage

The agent catalogue extends a set of specialised agents Cyware introduced in late 2025, including a Playbook Builder Agent and a Custom Code Generator Agent. Cyware said the new release pulls these elements into a more unified layer across the platform.

Cyware operates in a market that includes threat intelligence management, information sharing, and security orchestration. Many organisations use multiple tools for intelligence production, incident response, and coordination with partners. Cyware has positioned its software around operationalising threat intelligence and supporting collaboration between internal teams and external communities.

According to the company, the new agentic layer is designed for enterprises, government agencies, and information sharing organisations. Agentic AI Fabric will sit within the existing ecosystem and apply automation to workflows spanning intelligence collection and analysis through to detection and response.