Name: Recorded Future Roadmap: Q4 2026 Update
Uploaded: 2026-10-16T04:16:08.734Z
Duration: 1 h 8 s
Description: Recorded Future Roadmap: Q4 2026 Update

Transcript for "Recorded Future Roadmap: Q4 2026 Update": Hi, everyone. Welcome to our q four twenty twenty six product road map and recent releases webinar. We're so excited to have you here, whether you are here joining live in virtual real life, I won't say the acronym of what that would be, or if you're listening back to the recording later. We're excited to have you, and we're excited to answer a lot of your questions on our road map. My name is Kathleen Kuzma. I lead our technical marketing team. I've been at Recorded Future for over eight years now, both in technical marketing, but even longer time spent as a sales or a solutions engineer where I've worked with small, medium, and large enterprise customers across all of North America. I am clearly not alone on this webinar, though. I'm really excited to be joined by two of my colleagues, Jess and Carden, and I'll have each of them introduce themselves now. Thanks, Kathleen. Hi, everyone. I'm Jess. I'm a senior product marketing manager here at Recorded Future. Basically, what I do is I help take all the amazing features, functionalities that our product team, generates and helps deliver it, to you all. So great to be here. Yeah. Good morning, everyone. I'm Carden Moore on the cyber intelligence engineering team. We work on our team to provide recorded future data at the point of decision. So whether that's through integration, automation, in platform, or through AI and LLM kind of, solutions that we'll talk about today. So good morning, everyone. So excited to have both of them on, and, again, a little different sections too they'll each be covering. So a few housekeeping items before we get into the bulk of our conversation today. First, this webinar is being recorded. You'll be sent out to all registrants after the webinar is done, and this will be uploaded to the recorded future community. And then just a quick legal disclaimer, this road map is high level and reflects our current plans. As always, things can change, so there's no guarantee that everything we discuss will be delivered today. Our goal for the session is to give you insight into our product planning to the fullest extent possible, but please understand that things can change at any time. I also should note we're not gonna cover the road map for every single solution and use case. We would be here for hours, although I would be happy to do that. So just because we don't talk about a specific use case or solution area, such as, say, attack surface, that does not mean our team does not have new features and functionalities that are upcoming. So thank you all for understanding on our presentation today. So a quick agenda. This is how we will spend our time. I'll start off with a really quick vision and product strategy talking about our three main pillars and how this helps drive a lot of our product development across a lot of key solution areas. Then we'll chat through some of the recent releases for digital risk protection and what's upcoming, same for third party risk, which Jess will be covering. We'll briefly cover cyber operations and a road map of what we are doing, especially for integrations. But the bulk of our time will be spent on talking through the general availability for our MCP as well as what we are building for purpose built agents. So a lot of time will be spent there. Both Cartan will chat through MCP, demo a little bit. I'll walk through some of our agents and also demo some of those as well. We will have a q and a at the end of the session. Please use the q and a tab on the right hand side of your screen. We'll answer as many questions as possible live. If we don't get to your question, though, we will follow-up with you after the webinar. And last but not least, we have a lot of upcoming events on call to actions. All of those links are in the doc section from the predict save the date for 2027 to the call for presentations to the agent data interest form. As I mentioned, we will chat a lot more here about agents. Everything that Recorded Future builds and is building rolls up to three main pillars. The first being the source of truth with unbiased collection to help with better prioritization. That was one reason I actually joined Recorded Future eight years ago. I came from the intelligence community, and I was somewhat naive to realize how comprehensive other companies could be with the collection that they have. And most importantly, how does that translate to intelligence outcomes? That leads really well into the second pillar. But as we talk through some of the collection capabilities as well, we're always adding new collection sources, whether it's using our NetFlow intelligence data to increase our DNS and subdomain registrations to proprietary research from the group into bad ASNs or autonomous system numbers. So continuing to make sure we improve on the collection piece, which is really important because then that drives the automation for you all, whether it's purpose built, integrations. We'll chat through some of those recent integrations we have released as well as what's coming, as well as our MCP and agents. So a lot of time today will be spent on the second pillar. For the third pillar, control validation, it is tough. And, again, I grew up, so to speak, in the intelligence community. Just defining how intelligence led us to take outcomes and a return on investment can be difficult. So recently this year or earlier this year, I should say, we released an intelligence impact dashboard. We're also gonna be doing more with helping you all better quantify the investment that you've made in intelligence and outcomes that you can hopefully achieve... That you will achieve. One of the latest releases, and this really helps ground where we're going road map wise for digital risk protection, is on our digital risk protection workspace. This latest release is bringing together brand and identity monitoring into one workspace. This includes assets, alert configuration, detections, takedown coordination, and executive reporting, all live in one view. It's built around five key use cases from malicious sites to code repositories to executive and company impersonation. And it's not just the use cases that are new. For malicious sites, for example, we've combined the power of a variety of different alerts to make sure that that use case is extremely comprehensive. That also includes improved source coverage, including wider social media, OCR analysis, as well as the info sealer laws as a part of our identity exposures use case. We also have the AI alert triage agent, which is available for both malicious sites as well as dark web detections. This proposes a verdict right within the alert itself, explains its reasoning so an analyst can act and see why, though, they got that verdict before they act in the example with the screenshot here showing a suggested takedown and just being able to request a takedown from there. So Digital Works Protection was released last month, and we already have more than 800 customers who have already activated Digital Risk Protection, and we have, many of you all who have already deactivated some of your legacy alerts. A few other example wins here. One customer went from triaging 20 to 30 alerts a day, which that takes a long time, down to two to three every day because of the improved detection funnel into the alert capability that we've released as a part of digital risk protection. Quick note too for digital risk protection. If you also have the identity intelligence module, you will see the identity exposures right within the digital risk protection workspace. So I wanted to mention that. We also have released a few integrations with these new use cases, namely Splunk, Microsoft Sentinel, and very recently, ServiceNow SIR. Where are we going now with digital voice protection? One of the biggest focuses for the team is more integrations. This includes XOR, Google SecOps, and a detection API that is all slated to be released later this quarter. We're also expanding the AI triage agent to a few other use cases, namely code repositories. We're working on building agents that can handle some of the digital risk protection use cases, namely our takedown agent. And early next year, we will be releasing a new use case called public brand mentions that also will come with that AI triage agent. And with that, I'll pass it over to Jess to walk through some of the recent releases for third party and also what's coming. Over to you. Great. Thanks, Kathleen. So our third party risk... There we go. Okay. Perfect. Alright. Third party risk. Our solution here really brings together two things. Right? The threat intelligence on one side that's gonna tell you what is happening to a vendor right now. And then two, the risk ratings that tell you how well a vendor manages its own security. And so with our latest releases that we've had come out, it's really pulled those foundational workflows together, both into a singular platform. And that's gonna include the security profile, Recorded Future AI for third party risk, all the vulnerability exposure MCP servers, risk priority matrix, compliance and benchmarking, and the asset map. So a lot of feature names there, but, realistically, what this is doing is it's bringing all of the risk, risk scores into recorded future so that you're able to see how well vendors are, maintaining their own security while pulling in that threat intelligence for the third party. So you're getting those, two things combined all in one. Two of these here that I really wanna go deeper on is compliance and benchmarking. And so compliance and benchmarking, together, these two are really gonna help evaluate a vendor before you even start investing in a full assessment, or go go further down either the procurement road or maybe you're, evaluating some renewals that are coming up. Both of these are live today. And so first and foremost, with compliance, there's gonna be a new compliance tab on your company intelligence card, and this is really gonna show you how a vendor lines up, against those widely known industry standards, like your ISO two seven zero zero one, your NISTI, all those, typical compliance metrics there. And so you can filter those by industry. So if you're looking at, you know, a new financial services vendor, you can see the standards that matter there, and you can see where they line up, in conjunction with those compliance standards. And many of you... I mean, you have requirements that your vendors must meet, and the old way was to, you know, send a questionnaire, do some Google searching, and really take that manual approach of things. And so with this, you're able to get an early read, before you even ask the vendor anything. And this is really great too for coverage on maybe those lower tier vendors too, that you never wanna send a questionnaire to or, you know, just wanna take that first approach, seeing how they're doing first. Second is benchmarking. And And so this is actually gonna let you compare vendors to one another. You know, a risk score on its own doesn't necessarily tell you much because there could be an industry standard or maybe an outlier, something that's happening. So you can actually now, with benchmarking, put up to five companies side by side and just see kind of if... Is there a genuine outlier or score that is common in that sector. And so you can start this from the benchmarking tab, or any company intelligence card. So in one pass, you can essentially see a standard that a vendor aligns to and how they're gonna compare, with similar companies. Alright. Now let's get into what's coming up next for third party risk. On this side, we have something that I think is an ongoing challenge, not only, in the third party risk space, but just kind of in general. Right? It's too many alerts, not enough signal, and being able to filter through that all. So we're gonna build three new playbook alerts for third party risk. The first of those being dark web playbook alert. This is gonna monitor Telegram, ransomware, you know, your leak sites, and any sort of underground forms so you can catch those third party exposures at the earliest possible moment. And so you can configure it for any ransomware, data breaches, leaked data. So your team is only going to see what is relevant to your organization, and this is actually an early access today. And we will be launching this later this month. And the next two alerts that we're gonna talk about really build, on top of this. And so these two alerts here are gonna take you from exposure to action. First and foremost, we have a cyber incidents alert, and that's gonna pull related indicators into a single playbook and start classifying those, classifying those threats by business impact. So you're going to know what to do, when to do it, and in what order. Then from there, we're gonna take that to the next level, and we're gonna bring that to a zero day alert. And that's gonna scan for affected third parties, the moment that vulnerability is identified. And so each of these alerts, we're not only going to get their alert, but it's also gonna become with an impact assessment. So it's really more than just a notification. Right? You're gonna get what is happening, why you should care, and most importantly, how it's going to affect you. And so this is gonna cover the vendor's exposure, and your own first party, with the triage and remediation detail directly added to that CVE. From there, we can also draft those vendor questionnaires and executive summary, but that's kind of spoiling the plot for, what I have upcoming next. So the next two items that I wanna cover here are probably our most requested items here recorded for you, specifically around our third party solution. And so the first one being around assessments, questionnaires. This is planned for the start of next year, and anyone who runs vendor assessments knows the pain. Right? Questionnaires, they take weeks. There's a lot of manual inputs. There's a lot of back and forth and chitchatting with the vendor and trying to get answers for them. And sometimes those answer are only as good as what the vendor, is gonna tell you or what they have time to tell you because we all know, that everyone is running around doing 20 things at once. And so Recorded Future approach to this is gonna help answer the standard vendor questionnaires in minutes. It's gonna be mapped to more than 40 industry standards and using data that you already have on file. So we're gonna be combining all of the ratings, all the threat intelligence, and on top of the vendor's own inputs. So those answers are not only gonna be there, but they're also going to come with evidence. We're really gonna start focusing on the controls that matter for the vendors, and you'll get those answers much faster. And last but not least, where am I gonna keep track of all of this? Right? It's not just searching through my emails anymore. We're gonna be able to do this through the vendor portal, also planned for the beginning of twenty twenty seven. And so, of course, finding all of those risks and doing the questionnaires, that's the first half. The other half is then getting the vendor to fix it. Right? And today, like we said, that's gonna live in... Typically lives in those email threads and spreadsheets. With the vendor portal, this is gonna give you that shared workspace with your vendor. From the vendor's intelligence card, you can kind of select all the issues that you want. You can send those questionnaires, request remediation. The vendor is actually able to respond through here as well. So you can help easily track that status and and changes as they come. And so all of this and what we aim to do specifically with third party risk, as I mentioned earlier, bring all of these different workflows together in a single platform. You're able to pull from all the threat intelligence, third party data, and everything that exists within recorded future, to help streamline and make things much easier. So very exciting things for a third party through the end of the year, and coming up at the beginning of next. Alright. I have one item that I wanna touch on here in Cyber Ops before handing it back over. So a little fun fact for you, recorded feature fun fact. Watchless connectors are one of our most widely adopted enterprise capabilities within Recorded Future, and just based on this alone, it's easy to see why. Updating these watchlists by hand, it's pretty tedious. Right? And so we have watchlist connectors available for multiple watchlists starting with IP vulnerability, and most recently, an added connector for domain watchlist, which I wanna highlight here. But, essentially, what this does is you're able to connect to, you know, integrations that you already live and play within today. So it'll automatically update these watch lists. So recently, we've launched the domain watch list, intelligence graph connector. So that's automatically gonna update your domain watch list. It's gonna run that discovery about, you know, every five minutes or so so that it's constantly being updated. And then next up, which one I think we're most excited about, is the TechSec watch list. Coming in November and into December, you're gonna be able to... Connectors will be live for this for Microsoft Defender, Tenable, and ASI. So the products in your environment will continuously stay current on your watch list, and you don't have to go back and forth to update them. Alright. Back to you, Kathleen. Great. Thanks so much, Jess. Continuing on the cyber operations theme, as Jess just went through, She went through some of the updates we've made on automated watch list as well as what is upcoming, especially for that tech stack watch list. Very excited to make that available for our customers. A few other recent releases that we want to mention are are updates for some of the integrations we have focused on BAS or breach and attack simulation as well as pen test integration. I'll chat a little bit more about that on the next slide. Did wanna remention too some of the updates we've made on the pricing and how that impacts you all on how you all can use the consume recorded feature intelligence in your various integrations. That is the new pricing in 2025 or 2026. If you are on either of those price books, that does include unlimited integrations. It's one reason I have up the security architecture view that you can see on the right hand side of the slide showcasing how all the different automated watchlist connectors that are enabled, the capabilities of pushing data into Splunk, into XOR Sentinel, the dozens of integrations that we have or hundreds, really, to count partners, as well as the capabilities with autonomous for operations. So I did wanna mention that unlimited integration piece. From a data or source of truth pillar example, wanted to highlight a few of the newer types of data sources that we have added and made available via API. Those include a VPN and proxy, IP list, as well as an AI threat list, all of which you can find in the support site and, again, is available via API. We've also continued to make improvements and updates for collective insights or all the security detections that you all have connected and are prioritizing within recorded feature. For some of those BAS integrations, we have most recently released integrations with Pykus Security, SafeBreach, and Pantera. To find any of those integrations to set up, well, you just go into the integration center and integrations, click on the integration of choice, and just click the setup in the upper right hand part of your screen. That is how you would set up those integrations. In terms of some upcoming integrations related to the BAS use case, we have AttackIQ. The value of having any of these integrations, especially for you all who are using them, is identifying exactly the adversary techniques that could bypass existing controls, prioritize based on the threat actors of the malware that you're seeing the most in your environment. Autonomous or operations is a capability that we released earlier this year. This includes the ability to bring in your ISEC feeds to launch threat hunts, preventions, and detections across various integrations from Splunk to Microsoft to CrowdStrike Falcon, Google, Firewalls, etcetera. This also includes customized look back for hunts as well as summarize AI findings for any of the results that were found as a part of those hunts. As always, our upcoming releases are really focused on expanding integrations. That includes integrations with Cortex XAIAN and XDR later this quarter as well as Sumo Logic. Looking a little bit further into next year, we're doing more on the control validation side. So, again, how can we use both the data that we have and the connectors and integrations we have to help you all understand and validate the controls you have to make sure that if the next attack targets a very specific type of TTP, that you're able to detect whether or not you are susceptible to that TTP. We'll also include vulnerabilities in threat hunts that will also be slated for early next year as well as within the malware analysis size. So for those of you who have used our Auto Sigma or Auto Yara capabilities, all of which that we released last year. We are building parity into being able to create and use rules from our analysis into autonomous operations. Now what is not included on this slide is all the upcoming releases that are tied to our front hunting, detection, and prevention that falls more into our overall agents for MCP strategy, which we will now pivot to now. If you have not used the in platform of coremedia.ai in a while, I definitely highly recommend that you do. Lots of vast reasoning improvements, building more agentic capabilities. We've also increased the intelligence access that you can access within Recorded Future AI. One that I really wanna highlight and mention that I've used a lot is the malware analysis endpoints. So being able to search for the vast sandbox results that we have as a part of our hatching triage sandbox, looking for command lines that are found in specific samples and making a lot of really great research all within Report Feature AI. We've also increased the knowledge of support documentation because it's really important to be able to find how to use recorder feature, how to perform a specific use case. So all that is available now within Recorded Future AI. We've also recently expanded Recorded Future AI access to our third party intelligence customers to answer key third party risk questions, whether it's which of my vendors, for example, have had a recent data breach or have had an increase in stolen credentials, let's say, over the past ninety days. All that's available via Recorded Future AI. To get started, just click on the sparkle icon anywhere. And in a lot of intelligence cards, you'll see the option to start and chat with Recorded Future AI there as well. The most recent release, though, building on all the work we've been doing on our in platform Agenca capabilities is MCP Access. So as I mentioned, MCP Access is available to all customers on our unlimited pricing... Integrations pricing, so 2025 or 2026 price books. MCP really allows you to power your own agents and LM with recorded features intelligence. This makes it much better for your agents to make more decisions with grounded, traceable intelligence better than just, like, the probabilistic reasoning that an LM on its own would use. To show you what it'll look like, I'm gonna hand it over to Karvin from our CIE team who's... Has run so many workshops and custom engagements with our customers. Over to you, Carden. Excellent. Thank you, Kathleen. Appreciate that. So just to briefly begin and lay the foundation, what is model context protocol? So model context protocol is an open protocol that was established by Anthropic, the team behind Claude, in 2024. MCP defines how AI applications connect to external tools. I like to think of it as a universal adapter for LLMs to connect to other services. For recorded future, our MCP is another solution we are providing to unlock the data in our intelligence graph to enhance security workflows. I provided this visual as it helps to understand how Recorded Future MCP provides access to our intelligence. We have the Recorded Future Intelligence Graph with... Rich with dark web data, in sync group research, network intelligence, malware intelligence, threat data, risk scoring, just a ton, and we continue to grow, which we serve via API. Between the API and your local LLM or AI tool is where the Recorded Future MCP functions, acting as the interaction layer serving data in the form of tools. Currently, we have over 90 tools exposed. Each tool performs a specific function detailed by tool name and description developed by our team. LLMs can use the name and description inherently to perform typical security operation functions as we will see shortly, functions to analyze, to investigate, to disseminate, and more. The cyber intelligence team is currently building and delivering custom skills using the tools exposed by the Recorded Future MCP to provide automated solutions for Recorded Future clients. Recorded Future MCP alone is very powerful, but the true power of MCP, I think, is interconnectedness. As MCP continues to grow, many security tools are offering MCP connections. There is incredible power for managing risk when connecting multiple tools together using an LLM as a single pane of glass, leveraging the capabilities of LLMs to process, aggregate, and analyze large datasets. For example, with Recorded Future MCP connected as well as a vulnerability management detection and response tool, vulnerability scans can be enriched, prioritized by risk determined by CVE life cycle stage and exploitability, and assigned to remediation teams. Additionally, the Recorded Future MCP can take the most recent vulnerability scan and add it to the vulnerability watch list within the platform for continued risk monitoring. All this completed quickly with simple prompts. Automated agentic workflows can be built using Recorder Future MCP as the backbone providing threat intelligence on emerging TTPs and threat actor behavior correlated with your internal data from connected EDR, firewall, security tools for email to better understand and enhance your controls and risk posture. Also, with incident management systems connected via MCP, an analyst can pull incident tickets assigned to them, automate IOC enrichment using Recorder Future MCP, use the intelligence graph to search for patterns of maliciousness in the activity, query the malware intelligence database for linked malware, and check Recorder Future collective insights for like historical detections. They can then use other connected MCPP tools like a SIM or a SOAR to get detailed internal context on the activity before making a confident risk based triage decision. All this completed in a single LLM session, harnessing the power of communicating a natural language. The best example I can provide, though, really is is seeing the tool in action. So if I did it quickly, you can see that I have a cloud desktop session currently active, and I am connected to the Recorded Future MCP as well as a Splunk MCP. The Splunk is our demo instance. And full disclosure, I've provided synthetic logs in there so that we can get some rich threat intelligence. So the first thing that I really wanna do is use the Splunk MCP to see what fields are in the main index. Now I'm not a Splunk expert, but I know the data well enough to know within the main index, the source and source types that I'm looking for are exposed. So the Splunk MCP at that point kind of takes over. It looks at the available tools and begins to run a query. It presents back the source types that are in the main sample set to include those that have the most events, and then it begins to group in fields by what it thinks are the most pertinent while also letting me know that, hey. A lot of these are empty sets. They don't have anything in it with... Made sense for the synthetic logs that we've actually generated. So what I wanna do, is look further into this, and I saw one source type that's stuck out to me, which is the Skuid proxy logs, which essentially acts as a proxy in between, clients and and the Internet. So I want to investigate these proxy logs, and I just wanna ask Claude, show me anything that appears malicious. Notice I haven't done a a, very, specific prompt here, but you can get very specific in what you determine, malicious by making this prompt here. So I used the Splunk MCP server integration again, and I'm doing these requests. So it runs the Splunk queries for me. Just to show you what this looks like, this is the actual query that's here. But if you look in the Splunk enterprise instance that I have, I have our demo instance up here in searching and reporting. You can see that these queries are being made against my instance here, in the search mode, which is smart, which is meaning that it's actually coming from a connected MCP and being completed by Claude in this session. So, again, I'm not necessarily a Splunk expert, but I'm able to make Splunk queries to find what I'm looking for. Cloud, in this case, does an excellent job, pulls some, malicious traffic from these these proxy logs, and then makes a determination with, confidence levels. And we're gonna investigate this mozzie botnet payload downloads. It looks like it's requests that have these on random high ports, to include these IP addresses, and it gives me a readout of why it thinks these are malicious. That's great, but this is purely Claude's determination here. And, frankly, I don't trust it. I want some higher confidence. So what I'm gonna do is then use the recorded future MCP to enrich these IOCs. Let's look further at the Masebotnik activity and enrich with recorded future MCP. And, again, because the tools and this... Have descriptions inherent in them, I didn't have to be specific about the tools that are being called by, Claude because the recorded future MCP makes these tools and descriptions available. Claude reads those and then comes up with a plan on how it wants to investigate. If you had very specific investigative, tools that you wanted to use in succession, This is where our skill comes in. And, of course, like I said before, the CIE team that I'm on, would really like to to get involved in those conversations and talk how to build skills here. But just in here, Nate Cloud will jump in and begin to look for the tools that are in the MCP. You can see I already have a malware investigation skill that I've developed, so I want to make sure that that's put in when I'm enriching IOCs. It looks for the available of tools and then begins its investigation. One call that you might see, is this Git intelligence card. It's usually... It happens right after resolved entities so that we're looking at recorded future entity IDs. It resolves these IOCs, these IPs in this case, into Recorded Future entities to then use the Git intelligence card. And the return in this tool is, something that you're probably used to seeing if you're a current Recorded Future user, which is the criticality label, risk strings, and scores, the evidence strings for every single one of these IPs as well. So we're getting the rich risk content and the enrichment associated with every one of these IPs. Cloud continues to go on to do lots of enrichment activities, get more intelligence cards because it's doing bulk, IOC enrichment. Now we're looking at Insync notes by diamond models to see if they reverse, if some of this infrastructure is used and is known in diamond models that we've tagged in our InSync notes. We're getting summaries of those InSync notes, and then we pivot into where we're using the malware investigation skill to use malware investigation and our malware intelligence database to search for more mozzie tags. Ultimately, we come with a mozzie botnet activity with recorder future enrichment. So some of the key findings that we have on here, again, before, we were just looking at the telemetry, and the findings were based upon what Claude thought was risk. But now we've enriched that all with recorded future context to provide much more high confidence, understanding, of the risk associated with these IOCs. So we do have a malicious score tied with one of these IPs that we're seeing. We see InstaGroup validated as a part of the MOSI structure, as early as as yesterday, has proxy hits. I think this is extremely interesting as well that we see from the enrichment is that we do see some of these IP risk scores, are understated, but they still follow the same URL pattern that we're seeing as well as the combination of the high parts, which is a better detection signal. Now that is, of course, from the internal telemetry that we have combined with the threat research that we've done within Recorder Future to make a high confidence assessment on maybe an IP that is a dynamic I... IOC that can consistently change in the infrastructure. But based on the URL patterning, we can make high confidence, and enrichments and scores based upon that. So, essentially, we, enrich all the IOCs. We find the insect notes that are related to that. We do much more digging into the the Mozy malware as well. All this is brought back again by that simple prompt, that I shared previous, and we do have recommend... Vended actions here. So at this point, I think I've got a really good dataset. I've got tons of internal telemetry combined with tons of data from the recorder feature enrichment side. So I just want to compile this into a report that I can either share around or use for incident response. And this is exactly the bread and butter of LLMs is compiling and aggregating data in a way that can be disseminated. So it creates a markdown file that has the incident response report with all the data that I showed to include in the executive's summary, the scope and data, because I asked it to do this in intelligence form. So it really wants to give, where the the data came from and notify any gaps that it had in its process, timelines, the findings that are on there. A lot of the IOCs, they're actually clustered and then prioritized by risk. We have the IOC enrichment that we saw, before as well in the reports. The payload hashes that were known to be tied to this malware based upon the malware intelligence database. We have assessments, confidence, and then, the... An excellent portion of this is the recommended follow on Splunk queries. Now with these, we can dive deeper and do some threat hunting type of activity. And because we have the Splunk MCP connected, and now we have the data enriched for for... Recorded future and understand the true on threat, then we can take those and turn them into Splunk queries for further hunting. So any of these, I could action right away and have the the cloud use the Splunk NCP to actually begin to run these queries just like I did initially to look at the indexes and source types. So tons of information that you can, have there. This is just a quick workflow. Definitely not exhaustive. There's lots and lots that can be done with the MCP to include using this, and and a Jintiq solutions for backbones. But just to give you an idea, here's the 93 tools. I just asked what tools are exposed in the MCP. We have the 93 tools and bucketed into these categories of entity lookup and search, intelligence cards, risks, and lead. We're talking about enrichment, IOC enrichment in this case, the malware intelligence, which is looking really at our malware intelligence database, in sick notes to look at finished intelligence from the in sick group, ransomware and TTP data, collective insights. If you have detection set up and are using collective insights, then you can query collective insights to look at light detections, very similar to how you would use SPONK to look at internal telemetry. We have the ability to, interact with the threat map, so you can pull priority malware or priority threat actors and use those for threat reporting purposes or for further threat hunting activity. We do have attack surface intelligence tools as well as third party and vulnerability tools exposed, alerts and playbooks. If you want to search and get alerts and use this, as a plane for, triage and risk prioritization, you can use this, as I mentioned before, to interact with your watch list within the platform, like there's hour, and workflows associated with that, as well as influence operations, analyst note authoring, and some miscellaneous admin. So tons and tons that can be done with NCP. The workflow that I showed is just the... Truly the the tip of the iceberg there. If you are interested, in any of those, we on the cyber intelligence team do have, engagement that we've currently been running and working with clients, on all spectrums of the journey from just starting to adopt, AI and LOM locally to those that have, hooked up many MCP connectors and are ready to run with kind of AgenTic solutions. We'd like to get in front of you and then have these conversations atop deeper technical workflows. They typically go in this fashion where we do kind of an architecture review and then MCP demonstrations based upon your your use cases. We then design and workflows and map those workflows to your current processes so that you can get the most value out of the record future MCP. We talk about security best practices associated with AI and LLMs, what we're doing on our team to ensure security, and what you can do on your side to guardrail the use of those tools. And then, ultimately, we do road map development to talk about, what's coming in the future. So with all that, I've talked enough, and I'll pass it back to Kathleen. Thanks so much, Carter. That was extremely helpful to both walk through all of the different tools that are available now via MCP. And as Carter mentioned, across many use cases, not just our threat intelligence or cyber operations, but also attack surface. Did wanna mention in terms of other resources in the doc section, we have the MCP resources and overview. We also have the overview of the workshop that Carden just walked through. And I did wanna highlight that there is an open office hours that Carden will be joining and presenting on, and you can find the link to sign up is labeled office hours for MCP. So wanted to mention that before we move into... Actually, the last thing I'll just mention on Report Future AI, any of the new Report Future AI learn... Elearnings we have available on reported future, university are also all in the doc section. You all are sensing a theme here. Moving into the agent piece. So because of all the work that we've done over the past six months with MCP and a big thank you to all the customers who are a part of the beta program, the feedback and the use cases and the testing has really, really improved the capabilities that we are able to provide you all now generally available with MCP. So wanted to quickly say thank you again. In terms of our strategy too on the agent side, as we see, threats continue to continue to move fast, and this has honestly been a theme for years. But with AI, you really need to have defenders use AI to fight AI because of the familiar attack windows that are either getting compressed, the time to exploitations continue to decrease, and the capabilities of threat actors can also increase with various stages of the attack chain with using AI. So this is where we are very focused on how is Recorded Future as a part of the intelligence we provide with our intelligence graph combining with your private graph or your watch list, your collective insights, security detections, and looping in insights group research, making sure that we are that intelligence led foundation for agents. Because an agent also... In order to run, it needs a reason to run. It needs a trigger, whether that's... There was a change in your threat map where a new threat actor now became high priority. There should be actions and outcomes that can automatically be run because of that change. A few different ways that we are working on building different agents First is just platform as well as Intellis outcome focused agents, which we'll talk about in a little bit more detail. This is also going to include the capability to build your own custom agents. I know there are decent number of you on the call who have already built some of your own agents using the quarter features MCP in the past. So how can we make that process even easier for you all and also within recorded feature? And as we've already released MCP, all the agents, again, are building on all the tool sets that we are making available via MCP. As the team goes to build these different agents, there's a few different types of agents that they're really working on. First, from the platform focused side, this is going to include agents such as watch list maintenance and alert triage. I'm personally the most excited for the priority intelligence requirements or PIR agent that the team is building, which will help with creation, suggestion of new requirements, and upkeep, as well as the intelligence focused agents. So this is going to include purposeful agents for vulnerability prioritization, detection engineering. There's one question actually about our malware analysis capabilities. So a lot of those malware analysis capabilities are being built into various agents, including the detection engineering agent as well as agents that are being built for digital risk protection, such as the takedown agent, as well as some of the agents that Jess walked through that are very third party risk focused. Available ready today, we talked briefly again about autonomous threat operations. This is a capability we released last year and then throughout the zero been continuing to add new updates. We have the AI alert triage agents within digital risk protection, and Carden just walked through a ton of really great use cases using MCP. In terms of what's next, though, we have a beta enrollment interest form in the doc section to sign up for interest in testing some of these agents. And as I said, I'll walk through a few of them live here. That is going to launch in early November, and we'll be having beta feedback really through the end of the year as we launch some of these agents in January as well as an even bigger reveal at our user conference, Predict, in mid February. It's great to talk about agents, but let's actually showcase a few of those. Really quick disclaimer, kinda similar to the disclaimer I had before. What I am showing you right now that is available in your enterprise just for my own enterprise is very much... Might not look like what the full release will be. The goal is just to give you all a little bit of a sneak peek. So some things you might see on your screen, you maybe would not see if you're a part of the beta, so wanted to to mention that. When I click on report feature AI, I'll have intelligence agents that I can start workflows from or check what some of my triggers or what are the outcomes I'm already achieving with some of those agents. I click on discover agents. I'll see a variety of purposeful agents from the detection engineering agent to a PIRR agent as well as vulnerability prioritization. Let's briefly walk through the vulnerability prioritization agent. What's really cool about any of these agents that I've mentioned, you don't have to just ask a question to then have them run. We can set this based on a specific trigger. So whether that's I want to... For this specific agent, the whole goal is prioritizing vulnerabilities in my watch list or tied to my tech stack based on what should I absolutely patch now. So this agent really is gonna be the most useful for the CTI teams who are working with their vulnerability management teams that patch prioritization. This agent is gonna be built for you. What are some of those triggers I want to enable, etcetera? Let's go through an example of one of the agents. So for vulnerability prioritization, the main goal is to be pretty straightforward with the question I wanna ask. So let's just say I wanna prioritize my vulnerabilities. This is gonna be based on my vulnerability watch list. But also the capability for this agent to autorun based on a new vulnerability, let's say, that gets added to a watch list because of the watch list connectors that just walked through that you have up to date. Or you are using attack surface and you are using that automated connector to update, which is also forthcoming. For my watch list, this is what will happen as a part of that vulnerability prioritization agent. While this runs, essentially, what it's doing is gonna be looking through the vast amounts of intelligence for reported features vulnerability intelligence focused on the exploitation score. Are... Is there information for patching? What are the absolute ones of, let's say, 200 vulnerabilities that I have? Which of those should I absolutely patch now? Demo gods might be not as nice to me today, but, essentially, what you would see output wise would be, you know, priority zero. These are the ones you should patch. And as well as with the value of using agents, much more visualization capabilities, so being able to really prioritize and visualize those agents. One other use case I will briefly talk about, especially with some of the malware analysis and detection rule questions that are in the chat, is one of the detection engineering agents that is currently under development. This agent has access to the nearly 2,000 insect curated rules as well as a variety of open source signal rules that actually are not accessible anywhere else outside of the platform. This agent is specifically able to look at those. So let's say, for example, one of my questions is, I wanna find the latest to go strat signal role and then translate this into both CrowdStrike Falcon and Microsoft Sentinel. You can see all the different tasks that were created as a part of this agent, what is the most recent rule, which is just from earlier this month, and then what are those translated queries into both Falcon as well as Sentinel. Now as a part of beta into future roadmap, the goal is that, obviously, these agents can talk to each other. So the workflow would be the threat hunting agent would already call out to the detection engineering agent to translate signal rules, YAR rules, and translate into the translation query language that you need based on the technologies that you all are using. So a lot of really great development that is happening, but a lot of time for feedback for you all as a part of that beta program. I'll briefly stop sharing that screen before we go back to just the end here. Did want to also highlight. So Carden did walk through some of the capabilities with the Splunk MCP. I did wanna briefly highlight the threat hunting agent that is also under development and will be available to test for beta. As a part of this threat hunting capability, for example, one of my questions would be, I wanna hunt for GreenGolf over the last seven days. GreenGolf is an Iranian nation state threat actor. In this case, it's telling you all the IOCs I has found, the intel gathered. I'm approving this hunt. So throughout, making sure we're giving you all the approvals that you need, especially for a threat hunt depending on how large that threat hunt is going to be, and then the full output. So what is the... For the case of this hunt here, which is pretty long hunt, final report on the last seven days, what were all of these blank indexes that were queried? It has some value to abusing an agent through that agentic version of threat hunting is being able to look at other indexes that maybe you didn't originally ask for. Or, again, if you're trying to make sure your scope of your threat hunt is very wide or if you want it to understand and look at a different threat that maybe you didn't originally ask for but it's tangentially related, that is where the agent can come into play. Or, again, you have those guardrails and say, nope. Just run the hunt in this very specific way. Has all those matched IP addresses, any of the events, as well as what are some of the most critical notable events as well. Go back to our slides here to round things up for the hour. As I mentioned, if you are interested in our joining our agent beta, please fill out the interest form. That is the fourth document on the docs tab. You also can scan this QR code. I promise it is not malware. You can double check, though, if it's malware because you can submit a QR code to our sandbox. So you're all welcome to do that, although it'll be a pretty boring sandbox report. There have been a ton of questions in the chat, which is awesome. So I'll take some time now to answer anything, especially that I didn't already answer live. There are a few questions about MCP, what's available, and what's available to who. They wanna mention for MCP right now through the end of the year, those capabilities are available to set up if you're on our unlimited integrations package. Definitely please chat and reach out to your support team, your technical account manager, your account director to confirm and chat through, obviously, these use cases as well. There's a question as well also related to MCP if it's for any not plat... Any non platform integrated MCP usage. Yeah. So, I mean, the MCP itself will be accessible via OpenAI, Cloud, Copilot. I know there's a few different Copilot. There's a security Copilot as well as another Copilot. So, yes, it's available for all of those as well as Amazon. Medlock is another one. But... Yes. And if you are just using MCP in a non supported, like, direct integration, there are ways to access that as well. There was a question just double checking on when agents are being released. So, actually, let me quickly go back to that slide just because I think it'll be helpful for everyone. So the launch of some of these agents are going to be for general availability in late January as well as a bigger reveal at Predict in 2027, which we'll wrap up talking about. If you're interested, though, in testing any of the threat profiling, the vulnerability prioritization, which you kinda saw, you had to kinda use your imagination there, to... Or take down the agent or take down the agent actually be available later in the year or into q one. But we'll be starting the beta in early November with, again, general availability launch in January. So I did wanna mention that. As mentioned, if you have interest in agent beta, please reach out to your TAM. Sign up for it as well in the docs section. There's one other question more on MCP just on access to passive DNS data from MCP. That's a great question. I'm pretty sure that would come through some of the risk rules. So answer is yes, but I'll dig into that to to provide a little bit more of a a detailed response. Let's see. Any other last questions here I can answer? There's some questions too just about the timing for different integrations. I should mention for that XOR integration for digital risk protection, that is slated for October 30. So that is this month. So for those of you who use XOR, know that all those use cases will be available as playbooks at the end of the month. And with that, I believe that's most of the questions. If there are any other questions I missed, I'll have the full readout after we can definitely follow-up with the team as well. In terms of some upcoming events to round out the time we have here today, I've mentioned predict a few times. I'm so excited to announce predict twenty twenty seven intelligence in focus. This will be in DC or predicts DC, February twenty third and twenty fourth in Capital 1 Hall. Our Predict London will be back at the same location it's been at the last few years. So if you've been to Predict London in the past, it will be very familiar. Very lovely spot along some canal neighborhood there, which is really nice. Predict Tokyo, we'll have more details forthcoming. That will be in June. So more details on the exact date as well as the location. Terms of how Predict will be run, we have two day event. First day will be all recorded between university training. This will include a lot of probably detailed sessions on MTP, on agents, on more like public sector, geopolitical types of workflows, as well as capture the flag. So definitely encourage you all to attend. For the second day, that'll be keynotes in breakouts. And then as well, we would love to have you all. Well, not everyone can can chat at Predict, but we would love to have a lot of you present at Predict. So our call for papers or presentations is live. You can submit through November 21. That is the second link in your doc section of the within Goldcast. So really looking forward to seeing where those submissions are, and you will almost certainly be paired with someone like myself, Jess, or others if your presentation is chosen. So looking forward to seeing and working with some of you on those. There we go. It froze for a little bit. A few other things to mention, we are doing our second year of reported future excellence awards. Last year, we received over 220 nominations with so many incredible stories recognizing their colleagues' work. So it's really clear that the community does a ton of great impactful work using intelligence and wants to be recognized for it. This year, we're introducing two new categories that is excellence in learning and advocacy... In learning and advocacy. And the advocacy one is for customers to go above and beyond with championing a core feature within their organization. Nominations are available through November 20, and those who are awarded, you'll be notified on December 15 at the latest. So definitely wanna hear from all of you, submit your nomination again using the link in the box section. A few other items I wanted to mention, we have a few customer exclusive threat briefings next week. The first one on Tuesday, definitely sign up. Again, you'll have that recording. It'll also be available on the recorded feature community. First, reported feature is gonna cover Purple Delta's fraudulent employment operations, a very fascinating and scary use case. The second threat briefing next week is a researcher who's gonna talk about the impact of AI on vulnerability research, another very timely topic. So really excited to join both of those threat briefings. Again, QR code here. Links to join are also in the docs. And last but not least, one other upcoming webinar. We are talking a lot about MCP, and I'm really excited that I will be joined by David Clayton from the Tech Collective next Wednesday. Just kidding. A few Wednesdays from now. Wednesday, the twenty eighth, at 11AM eastern time, where David will walk through how he and the team have been using and building intelligence workflows using Recorded Features MCP as well as the other tools that are... Obviously, the value of MCP is to be able to connect to other security tools as well. So definitely sign up for that webinar. Again, we'll have that recorded and sent out to all registrants after. Thank you all again for joining. Thank you for all of the great questions. If If there are any questions, again, we didn't get to, we'll follow-up later, but we actually answered most of them. A big thank you as well to Jess and Carden for joining and presenting. It was really great hearing from Jess on everything with third party risk and all of the great capabilities that we're using with the GRC capabilities of Mastercard. So a big thank you to Jess. As well, the big thank you to Carden for walking through some of the MCP capabilities, all the use cases that he has worked on with customers. So that was a really great session, and I learned a lot as well. So see you all the next webinar, whether it's a live demo of everything or at Predict in person next year. Thank you all again, and have a great rest of your day.