Cyware Makes Threat Intelligence Move

At Quilter, the British wealth manager, a surprisingly ordinary chore was consuming security time: removing duplicate threat data. The same indicator could arrive more than once, leaving a person to sort out the repetition. In Cyware’s published case study, threat hunt specialist Ian Parsons put the saving from automatic deduplication at about eight hours a week. A working day, recovered from housekeeping.

Eight hours hiding in plain sight

Parsons had inherited Quilter’s tools when he joined in October 2022. Asked to review its intelligence provider, he consulted analyst recommendations and industry peers, then tried Cyware. The trial gave an abstract purchasing decision something concrete to turn on: whether the software matched the intelligence lifecycle and removed work. Quilter selected Intel Exchange, connecting it with its existing security information and event management system.

“Saving around eight hours of manual labour each week.”

Ian Parsons, Quilter · Cyware customer case study

This is a useful way into Cyware because cybersecurity marketing usually begins with the attacker. Here, the revealing character is the duplicate. A company can possess valuable warnings and still spend expensive human attention preparing them for use. Cyware sells software for that awkward interval.

The space between the tools

Anuj Goel encountered the broader problem while working on cyber strategy at Citi. Intelligence existed, but security functions did not always share it effectively or apply it across their systems. Akshat Jain brought engineering experience from Adobe and Oracle. Together, they founded Cyware in 2016 around a practical proposition: connect intelligence, workflows, and collaboration so defenders can respond with context.

The company calls this approach cyber fusion. Strip away the label and the work is recognizable: collect an indicator, check its context, decide whether it matters, move it into the appropriate security control, and tell the people who need to know. Each transition is an opportunity for delay. Automating those transitions is Cyware’s territory.

Four products, one handoff

Intel Exchange is the intelligence hub. It ingests, deduplicates, enriches, scores, and shares threat data. Collaborate handles secure exchange between teams and organizations. Orchestrate connects tools through low-code workflows. Respond adds incident response and case management. Buyers can also choose packaged suites rather than assembling every capability separately.

Consider a suspicious domain. A workflow could collect it from a feed, enrich it with reputation and campaign information, and send a sufficiently confident finding to connected security tools. That is an illustrative workflow, not a claim that every domain deserves automatic blocking. The organization still needs thresholds, permissions, and someone responsible for the result.

Cyware competes with threat intelligence platforms such as Anomali, ThreatQ, and ThreatConnect, while its orchestration capabilities overlap with SOAR products. Its pitch joins intelligence management, sharing, and action in a connected portfolio. That makes integration coverage and the quality of the handoffs central buying questions. Cyware advertises more than 400 integrations; a buyer should check the particular connectors their workflows require.

A warning worth passing on

The customer list extends beyond individual security operations centers. Cyware serves managed security providers, government agencies, and information-sharing communities. Public examples include Arvest Bank and MTS-ISAC, the maritime sharing organization. These networks matter because an observation made by one defender may help another - provided it arrives in a usable form and within agreed sharing boundaries.

In October 2026, WaterISAC confirmed a partnership to improve intelligence collection, analysis, and sharing across water and wastewater utilities. Its announcement connects that work to an expanded reach among small utilities through the National Rural Water Association. It illustrates Cyware’s collective defense proposition: a community can distribute expertise that each member would struggle to reproduce alone.

Cyware says more than 30,000 organizations benefit from its platform. Read that as ecosystem reach, including sharing networks. It does not establish that 30,000 organizations each signed a software contract. The distinction matters when judging both the company’s business and the distribution of its intelligence.

The price of fewer handoffs

The financing history is clearer than the price list. Cyware announced a $10 million Series A in August 2020, a $30 million Series B in March 2021, and a $30 million Series C in June 2023. The last round, led by Ten Eleven Ventures, brought reported total funding to $73 million. That is capital raised, not customer spending or revenue.

Customers receive scoped quotes. Seats, feeds, deployment model, automation volume, sandbox capacity, and add-ons affect the bill. Cyware advertises cloud, on-premises, and air-gapped options. The sensible comparison includes the labor needed to maintain integrations and investigate alerts, alongside the license. Quilter’s result suggests a measurement worth copying: establish the repetitive chore first, then test whether the trial actually removes it.

That test also has prerequisites. A team needs to know which systems it owns, what information may cross organizational boundaries, and which actions require approval. A sharing community needs members willing to contribute and rules they trust. These are operating choices a product cannot make for its buyer. They belong in a trial alongside connector checks and time measurements, before a broad automation rollout.

Let the agents investigate

The newer products extend the same thesis. In March 2026, Cyware announced Agentic Fabric, with an Analyst Agent Hub and agents for attack reconstruction, contextual intelligence, SOC analysis, and detection engineering. June brought SOCRadar-powered Digital Risk Protection, connecting external exposures and brand abuse with intelligence workflows. An Armis partnership adds asset context to the question of which threats matter locally.

The limits are instructive. Cyware describes its SOC Analysis Agent as an investigation aid, without autonomous remediation or destructive actions; its output depends on available intelligence. Bad context and neglected integrations remain bad inputs. The useful ambition is an analyst spending less time assembling evidence and more time judging it. Start with the duplicate, follow the handoff, and ask what useful action happened next.