The intelligence your SIEM is sitting on - See what Cyware and Microsoft are doing about it at RSAC 2026. March 24, 2026 Sachin Jade Chief Product Officer, Cyware Tl;dr. Most SIEMs absorb threat intelligence but never give it back. The result is a one-way system where hard-won detections stay siloed, invisible to every other defender facing the same threat. Cyware and Microsoft Sentinel have changed that with a native bi-directional integration that puts shared intelligence to work across the ecosystem. Key highlights: * Threat intelligence now flows both into and out of Microsoft Sentinel via STIX/TAXII, the same open protocol used for ingestion * IOCs and sightings detected in Sentinel are automatically shared into Cyware Intel Exchange for enrichment and redistribution * Any STIX-compatible tool in the ecosystem can participate framing an open standard * See it live at RSAC 2026, Booth #3329 Introduction. One of the primary problems facing defenders today is asymmetrical threat intelligence: data goes into the SIEM, but it doesn't come back out. That means no bi-directional threat intelligence sharing, no cross-border collaboration, and no collective defense. Cyware and Microsoft Sentinel teamed up to break this one-way intelligence barrier. The result is true bi-directional threat intelligence sharing between the two top-tier entities, which you can see in real-time at RSA. Detection without distribution is an incomplete defense. Threat intelligence for one is often threat intelligence for all. When analysts gain insight by identifying a novel threat in their SIEM, that information could inform other attacks within the vertical, potentially occurring at the exact same time. Historically, this information has often been closely guarded, but the time for infighting is over. As CISA states, "When an organization identifies threat activity and keeps it to itself, our adversaries win." However, in most environments, that hard-won threat intel goes nowhere but the platform that produced it. After investing so much in detections, defenders would do better to invest more in what happens to those detections after they occur: they should be leveraged for all they're worth. That's why the gap isn't about detection; it's about distribution. The asymmetry that defenders have quietly accepted. This asymmetrical standard has evolved in the industry over the years. Cyware Labs, Inc. take it for granted that the investigations, context, insight, and tribal knowledge of its teams will be used for its benefit and its benefit only. But despite competitive differences, Cyware Labs, Inc. is all fighting common cybercriminal adversaries, and what hurts one could hurt all. The danger of being an isolationist is that your organization falls prey to a breach that could have been prevented through participation in the threat intelligence sharing system. The technical disparity that creates this paradigm is that threat intelligence flows into SIEMs, improving detection, but no intelligence flows back out. This creates a wasted signal: a phishing campaign detected by one analyst in one company could have been avoided by others across the board. The root cause is structural: Threat Intelligence platforms aggregate intelligence from commercial feeds, open-source repositories, and sharing communities, then push it into SIEM platforms like Sentinel via STIX-formatted objects over TAXII. But until recently, no equivalent channel existed going the other direction. The insights SIEM generates correlating telemetry, identifying anomalies, producing environment-specific IOCs, had no standardized, automated path back out to the broader ecosystem. What couldn't be exported programmatically got shared manually, if at all. This paradigm needs to shift, and so do technical capabilities. When teams have the tools and ability to get that information back out of the SIEM and into the community, that shared threat intelligence has the power to protect hundreds of others within the same sector and strengthen the web of collective defense. What changes when intelligence flows in both directions. The Cyware and Microsoft Sentinel integration turns a unified threat intelligence management platform into a vehicle for threat intelligence sharing and collaboration. And it changes one thing: it establishes a standardized, automated path for threat intel to flow back out of internal tools and into the broader defender ecosystem - where it can do the most good. The mechanism is based on STIX/TAXII protocols - the same one used to push intelligence into SIEMS in the first place - and formatted for fast, secure, and automated machine-to-machine communication. This takes place via the Cyware Intel Exchange solution. This is how it works: * Bi-directional exchange via STIX/TAXII: Microsoft Sentinel now has a native capability to export threat intelligence to a TAXII-based destination, establishing architectural symmetry with how intelligence flows in. IOCs and sightings generated in Sentinel are automatically shared into Cyware Intel Exchange, creating a circular intelligence workflow rather than a one-way feed. * Automatic ingestion from Sentinel into Cyware Intel Exchange: Intelligence generated in Sentinel flows directly into Cyware Intel Exchange, where it can be enriched, validated, and redistributed, reducing time-to-action from hours to minutes. * Defender feed ingestion and enrichment: The integration also pulls in Microsoft Defender Threat Intelligence (MDTI) feeds, which are ingested into Cyware Intel Exchange, automatically enriched, and used to accelerate threat triage. Without this mechanism in place, threat intelligence could be shared manually back out to the community via ISACs/ISAOs, threat advisories, and feeds. But what once took hours or days is now reduced to a process of minutes, with no human intervention needed to shepherd it along. Attackers move fast. When analysts have access to shared real-world threat data just as fast, defenders stand a chance. Standards matter more than integrations. A key benefit is that the Cyware/Microsoft Sentinel integration is built on open standards. It isn't a proprietary connector that creates yet another new dependency. Instead, any tool compatible with STIX can participate and experience the same collaborative benefits. Any intelligence created in Microsoft Sentinel flows into a shared ecosystem, not a private pipeline between two vendors. It is the foundation of open standards that turn point-to-point integrations into community watering holes that benefit sectors, verticals, and industries, instead of creating new siloes. See it live at RSAC - A working demo. If your team is struggling with an asymmetrical threat intelligence model, book your live demo - not presentation - to see true bi-directional intelligence sharing in real-time via Cyware's integration with Microsoft Sentinel in Cyware Intel Exchange. Cyware Labs, Inc.'ll see you at Booth #3329, Moscone Center. Sachin Jade Chief Product Officer, Cyware. Table of contents.

Cyware, a cybersecurity platform provider, has unveiled its Agentic AI Fabric, introducing goal-driven AI agents designed to assist security teams with investigation, detection engineering and response activities. The announcement builds on the company's AI Fabric foundation launched in November 2025. The Agentic Fabric features an Analyst Agent Hub and an agent catalogue including specialised tools such as the Attack Flow Agent, which maps adversary activity to the MITRE ATT&CK Framework, and the Detection Engineering Agent, which generates threat detection logic and writes YARA/Sigma code. The system enables AI agents to function as collaborative digital teammates, executing multi-step cybersecurity tasks at scale. Cyware positions the technology as a response to adversaries increasingly weaponising AI to accelerate attacks, allowing defenders to operate at machine speed.

Cyware introduces Agentic AI Fabric to enable threat intelligence-driven workflows across the security ecosystem. New Analyst Agent Hub and agent catalog introduce a collaborative Agentic workforce to help security teams investigate threats, generate detections and coordinate response NEW YORK-(BUSINESS WIRE)-Cyware, the leader in AI-powered threat intelligence operationalization, secure threat sharing and collaboration, and Agentic AI based security orchestration and automation, today announced its AI strategy centered on Agentic Fabric. Building on the AI Fabric foundation introduced in November 2025, Agentic Fabric introduces agent-driven workflows designed to assist security teams across investigation, detection engineering and response activities. "Cyware is aggressively advancing threat-centric Agentic AI for cyber defense to meet pent-up customer and industry demand," said Sachin Jade, Chief Product Officer at Cyware. Share As cyber threats evolve and adversaries begin weaponizing AI to accelerate attacks, the Cyware AI Agentic Fabric empowers defenders with a native Analyst function powered by goal-driven AI agents capable of reasoning, planning, and executing multi-step cybersecurity tasks. These agents operate as collaborative digital teammates, orchestrating complex threat intelligence analysis and defensive actions at machine scale. "Cyware is aggressively advancing threat-centric Agentic AI for cyber defense to meet pent-up customer and industry demand," said Sachin Jade, Chief Product Officer at Cyware. "Agentic Fabric introduces an ecosystem of specialized agents that work alongside analysts, applying threat intelligence and correlated data and executing objectives across the entire security lifecycle. This approach empowers defenders to innovate at the pace of the adversaries they face." Key Capabilities of Cyware's Agentic Fabric: * Analyst Agent Hub: Available within the platform or via browser extension, this central hub allows analysts to coordinate and drive selected agents across various workstreams. * Agent Catalogue: A growing catalog of agents integrated across the Cyware product suite expand and accelerate threat intel and SOC Analyst use cases, including the following sampling of agents: * Attack Flow Agent: Reconstructs adversary activity timelines and maps activity to the MITRE ATT&CK Framework. * Contextual Intelligence Agent: Summarizes threat intelligence, converting raw data into plain language. * SOC Analysis Agent: Supports investigation and triage, helping analysts understand the context behind alerts and why activity may represent a threat. * Detection Engineering Agent: Assists analysts in generating AI-powered Threat Detection Logic (TDL), writing YARA/Sigma code instantly. * Enhanced Customer Response: Allows Cyware to create and deploy custom agents at high velocity to meet specific enterprise-grade use case requests. This release expands upon the specialized agents introduced in late 2025, such as the Playbook Builder Agent and Custom Code Generator Agent, weaving them into a cohesive, autonomous layer that elevates human capabilities. By combining collective intelligence with agentic automation, Cyware continues to define the future of AI-driven cyber defense. About Cyware Cyware is leading the industry in Agentic AI-powered operationalized threat Intelligence and collective defense, helping security teams transform threat intelligence from fragmented data points to actionable, real-time decisions. We unify threat intelligence management, intel sharing and collaboration, as well as hyper-orchestration and automation - eliminating silos and enabling organizations to outmaneuver adversaries faster and more effectively. From enterprises to government agencies and ISACs, Cyware empowers defenders to turn intelligence into action. More News From Cyware NEW YORK-( BUSINESS WIRE )-Cyware, the leader in AI-powered threat intelligence management, secure threat sharing and collaboration, as well as hyper-orchestration and security automation, today announced the launch of a new Cyware Quarterback AI solution delivering an AI Fabric to uniquely address security use cases. Cyware Quarterback AI was initially launched as a Co-pilot chat assistant in March 2024. Since that first release the AI market has evolved significantly and Cyware's AI strategy... NEW YORK-( BUSINESS WIRE )-Cyware, a leader in AI-powered threat intelligence management, automation, and security orchestration, today announced a strategic partnership with Microsoft built on deep product integrations to help global enterprises and public sector organizations operationalize threat intelligence with greater speed, ease and confidence. The partnership delivers a uniquely integrated threat intelligence workflow across Cyware and Microsoft Sentinel, giving customers a faster path... NEW YORK-( BUSINESS WIRE )-Cyware, a leader in AI-powered threat intelligence management, secure threat sharing and collaboration, hyper-orchestration and response, today announced it has become a member of the Microsoft Intelligent Security Association (MISA), an ecosystem of software development companies and security services partners that have integrated their solutions with Microsoft Security technology to better defend our mutual customers against a world of increasing cyber threats. Cywa... Cyware. Release Versions