Threat intelligence layer built for AI agents, with confidence scores and provenance on every answer

An agentic SOC breaks down at the enrichment step. Feeds disagree, most return a binary verdict with no reasoning attached, and an agent handed a flat malicious or benign flag has nothing to reason over and no way to explain the decision it made on that basis. Kyberis positions itself as the governed layer between raw feeds and the agent, normalizing intelligence from commercial and community sources into a knowledge graph that the company says covers more than twenty-five years of structured threat data, with indicators tied to the actors, campaigns, and infrastructure they belong to. Queries return a confidence score together with the provenance and evidence supporting it.

The interface is deliberately triple-headed. A REST API serves structured pipelines, an MCP server plugs into agent frameworks and clients including Claude, Codex, Cursor, LangChain, and Windsurf, and native agent capabilities handle entity resolution, evidence lookup, and relationship traversal directly. Because each capability is both agent-callable and analyst-viewable, a human can inspect the same graph the agent queried when reviewing an escalation, which is the practical requirement for trusting automated triage. The intended consumers are SOC platforms, SIEM deployments, autonomous hunting systems, and analysts working escalations, and the company also distributes an app through Splunkbase for teams integrating the intelligence into an existing Splunk stack.