How does Liberty91 speed up answers to intelligence requests?

Liberty91 gathers and reads your sources in the background, around the clock: open sources, paid vendors, the dark web, and social media. So by the time a request for intelligence reaches you, the reporting behind the answer is already collected, the indicators of compromise are already pulled out, the attacker behaviour is already mapped to MITRE ATT&CK, and the threat actors involved are already linked. You choose what the report should cover and the platform writes it.

Does Liberty91 replace threat intelligence analysts?

No. Liberty91 works for the analysts you have. The agents take on the slow parts: the gathering, the cross-checking, and the running picture of every sector, malware family, threat actor, supplier, and region, so nobody has to keep all of that in their head. Your analysts decide which Intelligence Requirements matter for a given request, frame the answer for the person who asked, and sign it off. The platform does the legwork and the analyst keeps the judgement calls.

What report formats does Liberty91 support?

Written threat intelligence reports, STIX 2.1 bundles, Sigma detection rules, and structured lists of indicators of compromise. You can read reports in the platform, receive them by email, pull them through the API, or send them straight into your SIEM, SOAR, threat intelligence platform, or ticketing system. Mailroom sends any mix of these formats to the right people and records every send in a Sent log you can search.

Can I customise the report structure and focus areas?

Yes. You pick who the report is for, choose the chapters and the areas it should cover, and can add the specific question you want answered. The platform then writes a report to exactly that shape, ready for you to review.

How do Intelligence Requirements help me answer questions faster?

Each Intelligence Requirement is a knowledge base on one topic, a sector, a malware family, a threat actor, a supplier, a group of systems, and the platform keeps it up to date on its own. Every piece of news that arrives is read against all the requirements it touches, so by the time a question reaches you, the evidence behind the answer is already gathered, matched up, and explained in your context. You pick who the answer is for and which requirements it draws on, and the platform pulls the evidence together into a draft with its sources. That leaves you deciding and reviewing rather than gathering and sorting.

How do I set up alerts for my top threats?

You mark the threat actors, malware, and vulnerabilities you most care about as Top Threats, then write alert rules from your own conditions, saying whether an event has to match all of them or just one, and where the alert should go: email, Slack, Microsoft Teams, your SIEM, or SOAR. Liberty91 checks every incoming event against your rules around the clock and sends the matches to you, with every send recorded in the Mailroom.

How do I show the value of the threat intelligence work we do?

Everything you send through Mailroom is recorded in a Sent log: what you sent, who you sent it to, in what format, and when. Filter it and you have the record of what your team delivered, ready for a programme review, a budget conversation, or anyone who asks what threat intelligence has done for them lately.

From Question to Report in 7 Minutes.

When someone asks your team a question about a threat, the answer should not take days. Liberty91 gathers and reads all your sources in advance and flags what matters to you the moment it appears, so your analysts spend their time on the answer instead of the search.

Start for Free

The Challenge.

People keep asking threat intelligence teams questions. What do we know about this piece of malware, who is this threat actor, what should we worry about in this region or this industry.

Answering one means going out to find whatever has been published, reading it, working out what it means, going back for more, writing it up, having a colleague check it, and only then sending it to the person who asked. That takes days, often longer.

Now that AI agents can do the finding and the first pass, there is no reason for people to carry all of that themselves.

Why the 80/20 split in CTI is structural, not a skills gap →

How Liberty91 Helps.

Every Source, Read For You

Liberty91 brings in all your sources, free and paid, dark web, and any of your own, and a set of AI agents reads each one straight away: whether it matters to you, which indicators of compromise are in it, which attacker behaviours it shows in MITRE ATT&CK terms, and which threat actors, malware, and vulnerabilities are involved. The work is done before you ask.

Pick Who It Is For and What It Covers

You choose the person the answer is for and the Intelligence Requirements it should draw on, the knowledge bases the platform already keeps up to date. The agents hold the topic knowledge so you do not have to. You decide and review; the platform pulls the sources together.

How Intelligence Requirements work→

Review and Send Through Mailroom

Within minutes the report is ready for you to read. Send it out through Mailroom, along with any indicators, Sigma detection rules, or STIX bundles the reader needs, and every send is recorded in a Sent log. That log is your record of what you delivered, to whom, and when, ready for the next programme review or budget conversation. You sign off on the framing and the judgement; the platform pulls the report together and keeps the proof that you sent it.

How Mailroom dispatches intelligence→

The gathering is already done.

Liberty91 pulls from all your sources around the clock and puts everything published about the same threat into a single threat event. Each source is rated for how reliable it is and given context from the others, so one event holds all the reporting on that threat, with what each source says shown side by side.

How much it matters to your organisation, what it could do if it reached you, and how well your existing defences hold up against it are already written out for each event. You open a threat event and the assessment is in front of you.

The Sources panel of a Liberty91 threat event, with every source that reported the threat listed side by side, each with its own reliability rating and stance

4 days → 7 min

Liberty91 turns four days of chasing sources and writing into seven minutes of reviewing a report the platform has already drafted for you.

Built to help analysts, not replace them.

Nobody can hold the full picture on every sector, every malware family, every threat actor, and every supplier the people you serve care about. The agents hold it and keep it up to date for you. That leaves you deciding what matters and checking the work, instead of memorising it and sorting through it.

The agents hold the topic knowledge

The agents keep an up to date picture of every sector, malware family, threat actor and supplier you care about, and read each new event against it. They keep that picture current so you do not have to carry all of it in your head.

Sorting happens on the way in

Every event lands in the Intelligence Requirements it belongs to. You decide which of those matter for the question in front of you, rather than sorting the stream by hand.

Briefs write their first draft

A weekly sector brief comes together out of the relevant requirements, so your time goes on the framing and the judgement rather than on collecting the sources.

Questions come back answered

Intelligence Requirements read each other. Ask a question and the platform builds one answer across every requirement that touches it, with its sources, ready for you to check and sign off.

Set up alerts for the threats you care about.

You decide what matters. Mark your top threats, set the conditions in plain terms, and Liberty91 checks every incoming event against them around the clock, so the moment something moves on a threat you are following, the right people hear about it.

Mark your top threats

Flag the threat actors, malware families, and vulnerabilities you most need to follow. The Top Threats dashboard keeps the latest news on each of them on one screen, so nothing important disappears into the stream.

How the Top Threats dashboard works →

Set the rules, get alerted

Write a rule from your own conditions, say whether an event has to match all of them or just one, and pick where the alert goes: email, Slack, Microsoft Teams, your SIEM, or SOAR. Matching events are sent to you as they arrive, and every send is recorded in the Mailroom.

How to set up automatic alerting →

One requirement, the right product for every reader.

The same Intelligence Requirement can give you a summary for the board, a package of indicators and detection rules the SOC can load straight into its tools, or a briefing for another analyst, whenever you ask for it. One body of work, in the form each reader and each system can use.

The people who act on it

Everyone gets the version written for their job, sent when it matters. A CISO gets the short executive read, a SOC lead gets the technical detail, the person who owns a system gets the part that affects their service, instead of one general report nobody opens.

The tools in your stack

The same intelligence also goes out in formats your tools can read: lists of indicators, Sigma detection rules, and STIX 2.1 bundles, delivered over TAXII, webhooks, and the API straight into your SIEM, SOAR, firewall, and threat intelligence platform through Mailroom.

The agents further down the line

Every indicator comes structured and scored, so the automated and AI security tools in your environment can take it in directly. It is built to be acted on by software, not only read by a person.

How to make your intelligence impossible to ignore →

Why Analysts Choose Liberty91.

From 4 Days to 7 Minutes

Days of searching, reading, thinking, and writing turn into a few minutes of reading a draft and improving it.

Consistent Quality

Every report follows the same structure and covers the same ground, so the quality no longer depends on which analyst happened to be free that week.

Track More, Report More

Liberty91 watches hundreds of sources at once, far more than anyone could follow by hand, and turns what is relevant into finished reports. The same team covers far more topics and threats than before, and gets more reporting out, without the manual grind in between.

More Reach From the Same Team

Your analysts stop spending their days gathering and cross-checking, and spend them on the bigger assessments, on looking ahead, and on the people who rely on their work.

Start for free.

Our free Community Tier is on the way, so you can put Liberty91 to work on your own threat intelligence with no budget and no team. Join the waitlist now: the first 100 sign-ups get a month of our Analyst Tier free.

Start for Free →

Prefer the command line?

Our CTI Skills pack is free, open source, and MIT-licensed. It gives you tools for looking up indicators, building threat actor profiles, and writing Sigma, YARA, and KQL detections inside your own AI coding agent.

Explore the free CTI Skills pack →

“Before Liberty91, our team spent days manually correlating threat data across disconnected feeds. Now we're producing more relevant, actionable intelligence in hours, outperforming our premium intelligence vendors. For critical infrastructure, that speed isn't just efficiency, it's a security imperative.”

James Guajardo, TAQA

From the case studies.

“We cover many more Intelligence Requirements with the same headcount and get actually relevant, actionable Intelligence Products out within minutes, without fear of missing anything critical.”

Threat Intelligence Lead, a major energy enterprise in the UAE

3 hours to 7 min

Average time from breaking threat event to finished, contextualised product

Read the case study →

“The vendors tell us what happened, and they do it brilliantly. Liberty91 identifies the relevant intelligence and tells us what it means for us, which is what our leadership actually needs.”

Senior Threat Intelligence Analyst, a UK-headquartered financial services group

3 hours to 7 min

From vendor report to "here is what it means for us"

Read the case study →

Frequently Asked Questions.

Want to see this on your own organisation?

Request a demo or start your free trial today, and get straight to AI-powered threat intelligence built around your organisation.