Cyware

Cyware sells Orchestrate and Respond inside a threat-intelligence-led company, with a low-code and no-code playbook builder, 150+ templates and a vendor-claimed 400+ integrations. It ranks first at 7.24, largely on one product page. Pricing is not published, migration is a one-line import and export claim with no format named, and one deal aggregator disputes its independent status.

What it is

Cyware sells a threat intelligence platform and Cyware Orchestrate, a low-code and no-code playbook builder with AI help for writing and debugging playbooks. Orchestrate runs in cloud and on-premise environments, starts playbooks from SIEM alerts, threat intelligence feeds, manual runs, schedules or the API, and lists SLA tracking, playbook version control and a mobile app for approving automated actions (vendor claims, read 2026-11-03). Respond is sold as case management. The Quarterback AI line became an AI Fabric on 2025-11-12, and an Agentic AI Fabric launched on 2026-03-18, per a search summary of the release.

The playbook artefact is a JSON file. Cyware techdocs, read through search summaries because the page returned an empty shell, say playbooks export as JSON, SVG or PNG and import requires JSON and the Import Playbook permission. Associated apps must be installed first or nodes break, and a name conflict creates a timestamped copy or replaces the playbook. Cyware is not a source row in the portability matrix, which covers nine other platforms. One aggregator lists an acquisition by Microsoft on 2025-10-14. No Microsoft or Cyware release confirms it, and the coverage of 2025-10-22 describes a partnership.

The vendor describes itself this way: Cyware sells a threat intelligence platform and Cyware Orchestrate, a low-code security automation product that builds playbooks across SIEM, EDR and other tools. Its intelligence products and its Orchestrate product are sold as separate modules. cyware.com, read 2026-11-03

How Cyware scores

Nine rows, weights summing to 100, each scored 0 to 10 from pages read on 2026-11-03. The part is score times weight divided by 100. How the scoring works.

Where Cyware is strong

• Authoring scores 8.5: a drag-and-drop designer, a low-code Python editor, 150+ playbook templates, and an AI playbook builder, code generator and run-log debugger. All of it is vendor claim. cyware.com, read 2026-11-03
• Approvals score 8.0: the page says critical automation decisions can be approved and run from the enterprise mobile app, and that playbook version control keeps audit trails. cyware.com, read 2026-11-03
• Cyware describes cloud-to-on-prem hybrid reach through lightweight integrator agents that avoid exposing internal networks. Whether Respond runs fully on-prem is unconfirmed. cyware.com, read 2026-11-03

Where Cyware is behind

• Migration is one line on the product page, "import/export playbooks" (vendor claim), with no file format, no source platform, no converter, no leaving guide and no list of what does not port. The row scores 5.0, the same as an unnamed translation claim. cyware.com, read 2026-11-03
• No price or pricing unit is published. The pricing page says cost is scoped per engagement by deployment model, analyst seats, intelligence feeds and automation volume. cyware.com, read 2026-11-03
• The 400+ integration count comes from one product page, the integrations page returned 404, and the 80 percent manual-task and 19x integration-speed figures have no stated basis and are graded D. cyware.com, read 2026-11-03

A fact only Cyware has

The Cyware Orchestrate page does not use the word containment, and its response language stays general, with no catalogue of native endpoint, identity, email, cloud or network actions published. cyware.com, read 2026-11-03

Pricing as published

Not published. The pricing page says cost is scoped per engagement by deployment model, analyst seats, intelligence feeds, automation volume, sandbox capacity, digital risk protection and add-ons. cyware.com, read 2026-11-03 (vendor claim)

Ownership and funding

One deal aggregator (Signalbase) lists Cyware as 'acquired by Microsoft' on 2025-10-14, undisclosed amount. No Microsoft or Cyware release confirms it. Partnership coverage from 2025-10-22 describes a partnership and product integrations, not an acquisition. Treat ownership as independent until a primary source says otherwise. trysignalbase.com, read 2026-11-03

Named customers

• MTS-ISAC source, read 2026-11-03 (vendor claim)
• Quilter source, read 2026-11-03 (vendor claim)

Recent releases

• 2026-03-18 Agentic AI Fabric launch with agent catalogue (Attack Flow Agent maps activity to ATT&CK). Reported in a search summary of the BusinessWire release; the release page returned HTTP 403 to fetch. businesswire.com, read 2026-11-03 (vendor claim)
• 2025-11-12 Quarterback AI upgraded to an AI Fabric of generative, agentic and in-product AI. Cyware describes the upgrade as speeding up threat intelligence and security operations work, including playbook creation, threat data collection, and detection and response. cyware.com, read 2026-11-03 (vendor claim)
• 2025-10-22 Strategic partnership with Microsoft for product integrations; Sentinel ingests Cyware threat intelligence; solutions in Microsoft Commercial Marketplace. Partnership and integrations, not an acquisition, per Channel Insider. channelinsider.com, read 2026-11-03

Claims Cyware makes about itself

These are vendor claims. They are not scored. Each carries an evidence grade: C means a vendor figure with no published method.

What the public pages did not say

• No published price or price unit; pricing page says per engagement
• No trial terms stated
• No analyst mentions found in this pass
• Acquisition by Microsoft (Signalbase, 2025-10-14) not confirmed by any primary source; Cyware newsroom (cyware.com/news) and BusinessWire returned no usable list (404 and 403)
• Integrations page https://cyware.com/integrations returned HTTP 404; the 400+ count comes from the Orchestrate page only, and named integrations were not listed
• No native containment action catalogue (EDR, identity, email, cloud, network) published

Gaps recorded on 3 November 2026. A gap is an absence on the pages read, and it is scored that way.

Who should shortlist Cyware

• You want playbooks and threat intelligence from one vendor, as MTS-ISAC does after more than three years on Cyware, per its own quoted statement.
• You need mobile approvals with audit trails and hybrid reach into internal networks.
• You can check the 400+ integration count against your own tools in a proof of concept.

Verdict. Cyware is first of 14 scored at 7.24, alone in its band and 0.47 ahead of Torq (6.77), though the lead rests largely on one vendor page and one row flagged for a re-read.

Cyware against the other eleven

• BlinkOps v Cyware
• Cyware v D3 Security
• Cyware v Google Security Operations
• Cyware v Mate Security
• Cyware v Microsoft Sentinel
• Cyware v Palo Alto Cortex XSOAR
• Cyware v ServiceNow Security Operations
• Cyware v Splunk SOAR (Cisco)
• Cyware v Swimlane (Turbine)
• Cyware v Tines
• Cyware v Torq

Alternatives to Cyware, ordered by the rubric.