Meet Harry
Your Real-Time Junior Threat Intelligence Analyst.
Harry is Liberty91's stack of AI agents, working as your dedicated threat intelligence analyst — monitoring hundreds of cybersecurity sources, analysing every event for relevance to your organisation, and delivering tailored intelligence in real-time.
Get Access to HarryWhat Does Harry Do?
Every time a cyber event happens that your organisation should know about, Harry sends an instant alert — with a summary detailing what is happening, why it is relevant to you, and what you should do about it.
Every morning, Harry sends a curated, personalised summary of everything that has been happening in the cyber threat landscape. Tailored to your organisation, your threat profile, and your assets.
And Harry scales indefinitely. Whether you are a single organisation or an MSSP with 500 customers, each gets their own dedicated Harry — trained on their unique threat profile, assets, and supply chain. Five Harrys or five hundred, the intelligence is always personal.
But who is this Harry, how does he know all these things, and how does he make it personal?
Harry runs the full intelligence lifecycle end-to-end, and plugs into tailored workflows for MSSPs, analysts, and security leaders.
How Harry Works.
Liberty91 works through a stack of AI agents, personified in Harry. He synthesises raw content from hundreds of cybersecurity sources upon publication, and presents anything relevant to your security teams.
Collection.
Harry reads everything — in real-time
Your users can feed Harry with any cybersecurity source they have access to. Open-source content like cybersecurity news, blogs, vendor reporting, vulnerability databases, ransomware data leak sites, and dark web monitoring are provided out of the box.
Subscribe to premium intelligence from Google Threat Intelligence, CrowdStrike, or Group-IB? Harry ingests those too. As soon as something is published from any monitored source, Harry analyses it.
Training.
Harry knows what matters to you
Harry needs to decide what is important to your organisation and what is not. At Liberty91, we have made this as effortless as possible: our analysts have decades of experience in cybersecurity, and we use that expertise to pre-train AI agents based on sector and geography.
Integrate with your Attack Surface Management solution, and Harry will always have the most up-to-date picture of your infrastructure. Exposing OpenSSH when a new zero-day drops? Harry tells you immediately — with affected assets and remediation steps.
Analysis.
Tailored, actionable — not generic
When Harry finds something matching your collection requirements, he checks it against your relevance thresholds. If a new threat meets that threshold, Harry generates a full analysis customised to your threat profile.
No more generic reporting that is hard to action. Every analysis is tailored to your organisation — your sector, your assets, your supply chain, your crown jewels.
Production.
Reports, integrations, and role-based delivery
Harry's analysis is available in multiple formats and languages. Reports contain executive summaries, strategic and tactical analysis, Indicators of Compromise, and detection rules.
Harry can send tickets to Jira, create events in MISP, or integrate with thousands of other tools through webhooks and a versatile API. He even tailors output to the recipient's role: a CISO receives strategic analysis, while a product owner gets vulnerability alerts with remediation steps.
Harry in Action.
Real-Time Dashboard.
Harry streams relevant events as they happen — tagged with MITRE TTPs and linked to your threat library.
Daily Morning Report.
Liberty91 Morning Report
to: security-team@acme.com
Daily Cybersecurity Morning Report — April 2, 2026
Tailored Threat Intelligence Report
Executive Summary
Critical cybersecurity threats including actively exploited Google Chrome vulnerabilities, regional scams targeting travelers and grieving families in the UK, and a complex web of data breaches and phishing campaigns impacting major technology companies.
Attack Surface Threats
Google Chrome — CVE-2026-5281
Actively exploited zero-day, CVSS 8.8. Patch by April 15.
EvilTokens Phishing-as-a-Service
New kit targeting Microsoft accounts via device code phishing.
SLSH / Scattered Spider Data Exfiltration
3M+ Salesforce records from major U.S. tech company.
Regional: United Kingdom
Reservation hijack scams targeting travelers via compromised booking systems.
Every morning, Harry delivers a personalised summary of everything relevant from the last 24 hours.
What Harry Delivers.
Written Reports
Executive summaries, strategic and tactical analysis — tailored to each stakeholder's role and needs.
IOCs & Detection Rules
Automatically extracted Indicators of Compromise and Sigma detection rules you can deploy directly into your SIEM.
STIX Bundles
Industry-standard structured threat intelligence for seamless integration with your TIP, SOAR, or SIEM.
Real-Time Alerts
Instant notifications via mobile, email, Slack, Teams, or dashboard — as soon as a relevant event is published.
Integrations
Jira tickets, MISP events, webhooks, and a versatile API — Harry connects to thousands of tools.
Role-Based Delivery
CISOs receive strategic briefings. Analysts get IOCs and TTPs. Product owners get vulnerability alerts with remediation steps.
Harry Learns Over Time.
Harry does not just follow static rules. As your team tracks new threats, monitors new threat actors, and assigns criticality to events on the platform, Harry learns what matters to your organisation and what does not.
The result is an AI analyst that becomes more effective the longer you use it — surfacing fewer false positives, catching more of what matters, and delivering intelligence that is increasingly aligned with your priorities.
Organisations using Harry experience:
7x
faster intelligence production
85%
quicker response times
24/7
real-time monitoring
Ready to do more with less?
Request a demo or start your free trial today. Get instant access to AI-powered threat intelligence tailored to your organisation.