Introducing Mobasi. DFIR agents that investigate incidents across endpoints, cloud, and SaaS, and help your team respond to threats quickly. Mobasi·October 27, 2026 Today Mobasi is launching Mobasi: DFIR agents that investigate incidents across endpoints, cloud, and SaaS, and help your team respond to threats quickly. Mobasi has seen the impact of machine-speed attacks and AI-driven discovery of exploits in software. The next wave will require a persistent defender: Two products. Investigate is an agentic workspace for DFIR teams. Load into one case, run many agents on it at once, and open any finding in the right viewer with one click. It's built for,, and. Defend is an Advanced Persistent Defender for: agents that run in your cloud account, investigate alerts to forensic depth, run hunts on demand, and contain threats with evidence behind every action. Built on evidence. Every answer Mobasi gives cites its sources: the email, the log record, the file on disk, the process in memory. Your team can check each one and stand behind it. Mobasi reads any evidence, including disk images, memory, phone extractions, mailboxes, cloud and SaaS logs, and network captures from Windows, macOS, Linux, iOS, and Android. Open them all in one case. Built for speed. Attackers move fast, so Mobasi built Mobasi from the ground up for speed. That means you can run analysis that used to take too long to do routinely, like memory analysis and deep disk forensics, on every case. Built for security. Mobasi runs on hardware or cloud accounts you control, and your evidence stays where it already lives. Prompts and results aren't retained or used for training, and every action is logged so your team can check what was done. Research. Mobasi study how AI changes both attacks and the evidence they leave: how agents carry out attacks, how to keep the tools defenders rely on secure, and how AI can make defenders faster. Through Sentinel, its security team has published 19 CVEs in open-source forensic tools. Get started. Follow Mobasi on X and LinkedIn for updates.