> ## Documentation Index > Fetch the complete documentation index at: https://developer.kyberis.ai/llms.txt > Use this file to discover all available pages before exploring further. # Why Kyberis > Understand the decision advantage Kyberis gives agents and security teams. Kyberis helps you move from threat data to defensible action. It does not just return reports, indicators, and CVEs. It helps agents and security teams decide what matters now, why it matters to a specific environment, and what action to consider next. ## The value Threat intelligence is noisy. The same campaign, CVE, or IOC can appear across many reports, and most feeds leave the caller to decide whether the item matters. Kyberis adds decision structure: * It resolves raw input into canonical threat entities. * It retrieves bounded evidence for specific claims. * It pivots through related actors, campaigns, malware, techniques, sectors, and indicators. * It ranks normalized signals against environment context. * It returns deterministic assessments with confidence, caveats, and evidence references. The result is a workflow an agent can execute, audit, and repeat. ## What changes with context Environment context changes priority. A vulnerability tied to internet-facing Exchange can be urgent for a healthcare organization with OWA exposure and low priority for a Linux-only service with no Exchange assets. Pass context such as products, vendors, capabilities, industry, geography, and external exposure to `/v2/prioritize` and assessment endpoints. Kyberis uses that context to return fields such as `environment_match_reasons`, `suppression_reasons`, `priority_score`, `confidence_score`, and `what_changed`. ## What agents can trust Kyberis investigation endpoints are designed for machine consumers: * Assessment serving paths are deterministic and LLM-free. * Evidence is bounded and referenced by evidence IDs. * Ambiguity is explicit through resolution status and candidates. * Confidence describes support for the result, not business impact by itself. * Caveats and unresolved gaps remain part of the response. * Request IDs, `run_id`, and `step_id` let you trace the workflow. Agents can branch on stable fields instead of parsing narrative text. ## Typical outcomes Use Kyberis when you need to answer: * Which signals deserve attention first for this environment? * Why was one signal ranked above another? * What changed since the last run? * Is this IOC known, suspicious, or unsupported by current evidence? * Does this CVE require immediate action for our stack? * Which related entities should we investigate next? ## Start with prioritization If the user asks what to investigate first, begin with `/v2/prioritize`. Validate the top one to three items with `/v2/evidence`, `/v2/relationships`, and the relevant assessment endpoint before recommending disruptive action. If the user starts from one entity, resolve it first with `/v2/entity-resolution`, then retrieve evidence, pivot relationships, and run the most specific assessment endpoint. Rank current signals for an environment before deep-diving every result. See how the same threat can produce different priorities for different environments.