Liberty91

Do More Threat Intelligence, Faster.

There is something in this morning's security news that matters to you. Finding it, and working out what it means for the systems you actually run, is the part nobody has a spare two hours for. That is the part we built Liberty91 to do.

Start for Free
https://platform.liberty91.com
The Liberty91 home dashboard with 30-day threat event, actor, malware, and IOC counts, top techniques and actors, and the source-country map

What reviewers say on G2.

“Intuitive Setup That Unifies the Full Threat Intelligence Lifecycle”

What do you like best?

“It’s intuitive and straightforward to set up. I can get a new client up and running within a day, so they have a threat intelligence capability almost immediately. It pulls the entire intelligence lifecycle into one place, from setting requirements right through to producing and delivering bespoke reports. It’s a genuine force multiplier for my team, and it’s reasonably priced as well.”

What do you dislike?

“I haven’t found anything I dislike so far. Setup and onboarding were straightforward, and I’ve been very happy with it.”

What problems is Liberty91 solving?

“It saves my team a huge amount of time collecting and making sense of intelligence from multiple sources, especially when several sources are reporting on the same thing. Its agentic workflows help collect, analyse and produce intelligence at what I’d describe as a competent junior analyst level, giving us more time to focus on other work.”

Chris K., Founder, Mid-Market, 51 to 1,000 employees. November 2026.

“Automated, Actionable Cyber Threat Intelligence at Scale”

What do you like best?

“Integrating Liberty91’s AI enrichment into the OpenCTI ecosystem feels like a natural fit. It gives our users automated scoring, deduplication, and contextualisation at scale, helping turn raw threat data into prioritised, actionable intelligence without all the manual effort.”

What do you dislike?

“Like many similar platforms it takes a little time to ramp up and become familiar with all of the functions and features available in Liberty91, and to configure and refine from initial deployment.”

What problems is Liberty91 solving?

“Centralisation of intelligence into a single platform from multiple sources and enabling the full analytical lifecycle from ingestion to reporting reduces the need for users to log into multiple tools, increasing operational effectiveness and efficiency.”

Verified user in Information Technology and Services, Mid-Market, 51 to 1,000 employees. October 2026.

“Liberty91: Simplifying Work and Boosting Efficiency”

What do you like best?

“What I like best about Liberty91 is its user-friendly interface, efficient workflow, and ability to bring relevant information together in one platform. It helps streamline day-to-day tasks, improves visibility, and makes it easier to access the information needed to work effectively.”

What do you dislike?

“I don’t have any dislikes about Liberty91. Overall, I’m very satisfied with the platform.”

What problems is Liberty91 solving?

“Liberty91 helps streamline workflows by bringing relevant information and tools together in one platform. This saves time, improves efficiency, and makes it easier to access the information I need, allowing me to work more effectively and focus on important tasks.”

Verified user in Consulting, Mid-Market, 51 to 1,000 employees. October 2026.

Read the reviews on G2

What is Liberty91?

Somewhere in the last 24 hours of security news there are a handful of things that genuinely matter to you, and telling them apart from everything else is a couple of hours a day nobody has spare. Liberty91 exists to drastically reduce the time you spend on threat intelligence and security research.

So it reads the events for you, works out what they mean, and writes them up against what your organisation actually runs. The agents apply the same tradecraft you would, which is how they rapidly identify and prioritise critical threats and you can respond instantly. Your own time goes back to the work that genuinely needs a person.

7x

Faster intelligence

85%

Quicker response

24/7

Threat monitoring

Start for Free

An Analyst's Assistant That Never Sleeps.

Think of it as a real-time junior threat intelligence analyst who started this morning, already knows your environment, and never goes home. Behind that there are several specialists rather than one model doing everything: knowledge agents that keep themselves current on the threats you care about, and tradecraft agents that put every event through the methods you would use yourself, rating the source on the Admiralty scale and weighing each possible explanation against the evidence (Analysis of Competing Hypotheses).

What comes back is analysis at both the big-picture and the day-to-day level, the indicators of compromise tied to an attack (the IP addresses, domains and file hashes), and detection rules to go with them. Take it as a written report, as a STIX bundle, or pushed straight into whatever security tools and workplace apps you already run.

And it scales indefinitely. One dedicated analyst for your own organisation, or hundreds across your MSSP customer base, each running its own set of agents that knows that customer's environment.

Start for FreeMeet your AI analyst →
Liberty91 AI intelligence engine

Analyst or team of one?

If you are the security team, or close enough to it, our free Community Tier lets you put AI-powered threat intelligence to work without a budget behind you. There is no credit card to enter and nothing to install. Prefer to build it yourself? Our CTI Skills are free, open source, and run inside your AI coding agent.

Start for Free →Explore free CTI Skills

Built for Your Role.

For Analysts.

The collection is finished before you sit down: the sources are pulled together, checked and cross-referenced, and every threat event arrives with a plain description of why it matters to you and what it could do. The Requests for Intelligence your colleagues drop on your desk get answered in minutes, and what you find turns into Sigma, YARA and KQL rules without you writing them from scratch.

Learn more →

For MSSPs.

Sell threat intelligence under your own brand without having to build the practice first. Each customer gets reports written for them, surfaced, prioritised and drafted in real time, so you reach them with it before anyone else has noticed. Work that used to take two days takes seven minutes.

Learn more →

For Security Leaders.

Stand up a threat intelligence capability that works on day one, without the cost, the complexity or the long wait. It serves everyone with a stake in security rather than only the SOC, and it sets developing threats against the controls you already have, so you can see which ones need shoring up first.

Learn more →

Results customers measured.

From analyst teams to MSSPs to the office of the CISO: what changed, measured in their own numbers. Each study is drawn from a customer interview, with role and organisation verified by Liberty91.

3 hours to 7 min

Average time from breaking threat event to finished, contextualised product

Read the case study →

95%

Of products delivered were rated relevant by stakeholders

Read the case study →

30

Customer organisations served by one MSSP on Liberty91

Read the case study →

All case studies

Intelligence Requirements.

An Intelligence Requirement is just a question you need answered on an ongoing basis. Which ransomware crews are working our sector? Is anyone selling access to our suppliers? What is being said about this one executive? Liberty91 turns each question into a knowledge base that keeps itself current, and reads every incoming event against every requirement it touches, so by the time something reaches you it already carries everything learned on that topic so far.

We keep our own Intelligence Requirements up to date as a shared knowledge base, and you write your own on top of it. Yours stay private to you, whether you are running them for your own organisation or, as an MSSP, on behalf of your clients. They also refer to each other, so one question comes back as a single answer with citations drawn from everything relevant, rather than a pile of separate results.

See how Intelligence Requirements work →
https://platform.liberty91.com
The Liberty91 Intelligence Requirements library, continuously updated knowledge bases for regions, threat sources, threat types, and threats to your environment

Platform Features.

https://platform.liberty91.com
Liberty91 Modules overview with the Collection grid including CrowdStrike, FalconFeeds, Group-IB, and X above the Analysis modules for enrichment

Real-time collection.

We watch hundreds of sources for security news and threat reporting around the clock, so nothing lands at three in the morning with nobody reading it.

  • Security News & Blogs, Vendor Reports
  • Premium Intelligence Sources
  • Darkweb
  • Social Media
Liberty91 relevance analysis on a Threat Event, naming the customer organization it matters to, the Intelligence Requirement it matched, and the MITRE ATT&CK techniques with how each was used

Instant analysis based on your profile.

Every event goes through the tradecraft you would apply yourself, from rating the source through to weighing each possible explanation against the evidence, and then gets judged on how much it matters to you in particular. Connect your attack surface, supply chain and asset inventory tools and that picture of your environment keeps itself current, so the judgement stays right as things change.

Start for Free
A finished Liberty91 intelligence report as a branded PDF, the cover with its TLP classification beside a body page of written analysis

Actionable reports and alerts.

You get an alert the moment there is something you need to know. The same thing can go straight into whatever you already run, whether that is your ticketing system, your SIEM, your SOAR or your threat intelligence platform.

https://platform.liberty91.com
Liberty91 Mailroom dashboard for a month of sends, counting reports, IOCs, detection rules, STIX bundles, and alerts against the previous period, broken down per client organisation

Get intelligence to the people who act on it.

Mailroom gets the finished work to the people who act on it: reports, indicators of compromise, Sigma detection rules, STIX bundles. Everything that goes out lands in an auditable Sent log you can filter per organisation, so there is one record of what was sent, to whom, when, and in what format.

How Mailroom works→
The Documents section of a Liberty91 Organization, with the upload panel and two uploaded documents already extracted and reviewed

Set up an organisation in minutes.

There is no manual data entry to sit through. Upload what you already have, an asset inventory, a supplier register, a network diagram, a corporate profile, and Liberty91 pulls out the Assets and Suppliers for you to confirm in a couple of clicks. The agent looking after that organisation remembers all of it, so every new event is judged against your real environment rather than a generic one.

The SIGMA tab of a Liberty91 intelligence package for a WordPress pre-authentication RCE, with five generated detection rules including full detection logic and false-positive guidance

Use detection rules to take immediate action.

Every intelligence package comes with more than indicators of compromise (IOCs). You also get Sigma detection rules written for the specific threat in that package, ready to drop into your SIEM or take on your next hunt, and each one tells you what to look for, where to find it, and what is likely to set off a false positive.

Start for Free
L91

Liberty91 Morning Report

to: security-team@acme.com

Daily Cybersecurity Morning Report, April 2, 2026

Tailored Threat Intelligence Report

Executive Summary

Critical cybersecurity threats including actively exploited Google Chrome vulnerabilities, regional scams targeting travelers and grieving families in the UK, and a complex web of data breaches and phishing campaigns impacting major technology companies.

Attack Surface Threats

Google Chrome, CVE-2026-5281

Actively exploited zero-day, CVSS 8.8. Patch by April 15.

EvilTokens Phishing-as-a-Service

New kit targeting Microsoft accounts via device code phishing.

SLSH / Scattered Spider Data Exfiltration

3M+ Salesforce records from major U.S. tech company.

Regional: United Kingdom

Reservation hijack scams targeting travelers via compromised booking systems.

View Full Report in Platform

Arrive at the office in-the-know.

The daily email does more than round up last night's security news. It summarises what was published in the last 24 hours, works out what it means, and tells you how much of it applies to you, so you walk into the office already knowing which of it touches your organisation, your sector and the systems you actually run.

Start for Free

Frequently Asked Questions.

Want to see this in your own organisation?

Request a demo, or start for free right away, and you will be looking at actionable, real-time, relevant threat intelligence built around your own organisation instead of generic reporting.