Real Intelligence at Machine Speed, No Team to Build.
You get what a mature threat intelligence team produces, from day one: threats matched to the systems you run, the suppliers you depend on, and the defences you already have, each one with the indicators to search for, detection rules, and the steps to fix it. No six-figure analyst hires, no 12-month build, and no waiting days for an answer.
The Challenge.
Running threat intelligence properly means doing a lot of jobs in a row: working out which questions matter, gathering from hundreds of sources, reading every event and working out what it means for your organisation, getting the answer to the people who need it, and finding out whether it helped.
Few organisations can put people on all of that. So the security news gets read hours after it is published, it becomes a vague sense of what is going on, and it stops short of the actions it should have led to. Leaders end up feeling one step behind and worried they will miss something serious.
What they need is threat intelligence that works: every relevant event turned into a report, a list of indicators, a detection rule, and a fix. Without hiring a team to build it.
How Liberty91 Helps.
Say once what you need to know
Write down the questions your organisation needs answered. Liberty91 turns each one into an Intelligence Requirement and keeps it up to date on its own, covering threats, the systems you run, the suppliers you depend on, and the people and projects particular to you. Every incoming event is read against the requirements it touches, so what reaches you already carries everything known so far.
Learn how Intelligence Requirements work→The agents do the grind, around the clock
Every requirement keeps its own knowledge base current, and the agents apply the methods a trained analyst would use to each event: rating how reliable the source is on the NATO Admiralty scale, weighing the competing explanations against the evidence, and saying how confident they are. They work together to read each new event against your profile, the technology you run, and the suppliers you depend on. The gathering, the filtering, the matching up, pulling out the indicators, and writing the detection rules all happen with those methods built in.
You get answers, not a reading list
Briefs you can take to the board, answers to questions in minutes, Sigma detection rules straight into your SIEM, and the steps to fix what is exposed, each one tied back to what you asked to have watched. Mailroom sends every piece to the person who acts on it and records the send in a log, so you can show what was shared, when, and with whom.
How Mailroom dispatches intelligence→Not a chatbot, a working intelligence function.
A general-purpose AI answers whatever you type into it. Liberty91 runs the whole job continuously and without a team to run it: choosing what to watch, gathering it, sorting it, working out what it means, sending it on, and learning from what came back.
It is a set of agents that keep themselves up to date, not a series of one-off chats. Every new event is checked against your Intelligence Requirements and the rest of your profile as it happens. Gathering from hundreds of sources, pulling out the indicators, matching events up, and drafting the reporting, the grind of it, is handed to the agents.
Your analysts, if you have any, get their time back for the part only people can do: the bigger assessments, the conversations with the people who rely on them, and following a hunch to see where it leads.
Intelligence for everyone who needs it, not just the SOC.
Threat intelligence pays for itself once it reaches everyone who acts on it. Liberty91 produces the right thing for each of them in your organisation, in a form they can actually use.
Your people.
Briefs for the board, short summaries for management, and full written reports for the SOC and the incident response team. Everyone gets the version that answers their question, sent when it matters.
Your tools.
Lists of indicators, Sigma detection rules, and STIX 2.1 bundles delivered straight into the SIEM, SOAR, threat intelligence platform, and ticketing systems you already run. Liberty91 fits around what you have, so there is nothing to pull out or replace.
Your agents.
Structured intelligence that machines can read, ready for whatever AI agents your team adds next. As your security organisation starts using them, the intelligence they need is already flowing.
Coverage that scales without growing the team.
Hundreds of standing topics stay current on their own, because the platform keeps each Intelligence Requirement as a knowledge base that updates itself. Sectors, malware families, threat actors, supply-chain topics, none of them wait for an analyst to re-read them on Monday morning. Every incoming event is read against the requirements it touches, so it arrives carrying more background than any one analyst could realistically hold in their head.
Your team adds the requirements that are specific to you: the technology you run, the suppliers you depend on, and the senior people and projects particular to your organisation. Those stay private to you, the platform keeps them current, and they are read alongside the shared knowledge base whenever you ask a question. Board prep, answering a question from a colleague, briefing on a risky supplier, the answers your team puts together are already framed correctly, because what sits behind them is already up to date.
Real-Time Dashboard.
Daily Morning Report.
Liberty91 Morning Report
to: security-team@acme.com
Daily Cybersecurity Morning Report, April 2, 2026
Tailored Threat Intelligence Report
Executive Summary
Critical cybersecurity threats including actively exploited Google Chrome vulnerabilities, regional scams targeting travelers and grieving families in the UK, and a complex web of data breaches and phishing campaigns impacting major technology companies.
Attack Surface Threats
Google Chrome, CVE-2026-5281
Actively exploited zero-day, CVSS 8.8. Patch by April 15.
EvilTokens Phishing-as-a-Service
New kit targeting Microsoft accounts via device code phishing.
SLSH / Scattered Spider Data Exfiltration
3M+ Salesforce records from major U.S. tech company.
Regional: United Kingdom
Reservation hijack scams targeting travelers via compromised booking systems.
3%
Only 3% of security leaders can show, with evidence, what a given threat means for their organisation. The other 97% do not need another dashboard, they need something that produces the answer. That is what Liberty91 does.
Why Security Leaders Choose Liberty91.
The gathering, done for you
Hundreds of sources (open, paid, dark web, vendor feeds), read around the clock and filtered against what you said you need to know on the way in. No project to tune the feeds, and no queue of events waiting for someone to sort them.
The analysis, done for you
Agents work together to read every event against the technology you run, your suppliers, your senior people, and your requirements. They match events up and add the context from other sources on their own, and only bring a person in where judgement is needed.
The writing and sending, done for you
Different people need different things. Briefs for the board, Sigma rules and indicators the SOC can load, short summaries for the executive team, reports written for a customer, all produced when you ask and sent through Mailroom with a record of every send.
Threats weighed against your defences
Threats as they develop are compared with the defences you already run, so you can see which ones matter most against what is coming and spend your budget accordingly.
Value from day one
You get something you can act on immediately. The first reports, lists of indicators, and detection rules arrive as soon as your profile exists, not after a quarter of tuning and setup.
The team without the hiring
All of the above is what a mature five-person threat intelligence team produces, without the hiring, the 12-month build, or the six-figure annual spend.
From the case studies.
“We spent two years and serious money building a programme that summarised the news. This started answering 'what does it mean for us?' in the first week.”
CISO, a large UK bank
95%
Of products delivered were rated relevant by stakeholders
“'Your exposure to ransomware went up this month by 2%, based on these threat events. The following controls will help close that gap.' is the kind of insights we can now confidently articulate to the board.”
Head of Security Risk, a large insurance company in the UK
Days to minutes
Time to answer "are we exposed to this?" for a breaking vulnerability or supplier compromise
Frequently Asked Questions.
Want to see this on your own organisation?
Request a demo or start your free trial today, and get straight to AI-powered threat intelligence built around your organisation.