Why Kyberis

Kyberis helps you move from threat data to defensible action. It does not just return reports, indicators, and CVEs. It helps agents and security teams decide what matters now, why it matters to a specific environment, and what action to consider next.

​

The value

Threat intelligence is noisy. The same campaign, CVE, or IOC can appear across many reports, and most feeds leave the caller to decide whether the item matters. Kyberis adds decision structure:

• It resolves raw input into canonical threat entities.
• It retrieves bounded evidence for specific claims.
• It pivots through related actors, campaigns, malware, techniques, sectors, and indicators.
• It ranks normalized signals against environment context.
• It returns deterministic assessments with confidence, caveats, and evidence references.

The result is a workflow an agent can execute, audit, and repeat.

​

What changes with context

Environment context changes priority. A vulnerability tied to internet-facing Exchange can be urgent for a healthcare organization with OWA exposure and low priority for a Linux-only service with no Exchange assets. Pass context such as products, vendors, capabilities, industry, geography, and external exposure to /v2/prioritize and assessment endpoints. Kyberis uses that context to return fields such as environment_match_reasons, suppression_reasons, priority_score, confidence_score, and what_changed.

​

What agents can trust

Kyberis investigation endpoints are designed for machine consumers:

• Assessment serving paths are deterministic and LLM-free.
• Evidence is bounded and referenced by evidence IDs.
• Ambiguity is explicit through resolution status and candidates.
• Confidence describes support for the result, not business impact by itself.
• Caveats and unresolved gaps remain part of the response.
• Request IDs, run_id, and step_id let you trace the workflow.

Agents can branch on stable fields instead of parsing narrative text.

​

Typical outcomes

Use Kyberis when you need to answer:

• Which signals deserve attention first for this environment?
• Why was one signal ranked above another?
• What changed since the last run?
• Is this IOC known, suspicious, or unsupported by current evidence?
• Does this CVE require immediate action for our stack?
• Which related entities should we investigate next?

​

Start with prioritization

If the user asks what to investigate first, begin with /v2/prioritize. Validate the top one to three items with /v2/evidence, /v2/relationships, and the relevant assessment endpoint before recommending disruptive action. If the user starts from one entity, resolve it first with /v2/entity-resolution, then retrieve evidence, pivot relationships, and run the most specific assessment endpoint.