Cyntelligence is a funnel with a crew. Four stages carry raw intelligence from the open internet down to the handful of cases an analyst actually works — and a fleet of six named agents does the narrowing at each step. Every number here is measured from our own production deployment — a dated snapshot, not a live feed, and not a promise about your numbers.
§ 01THE PIPELINE
Read it left to right: we ingest everything, enrich all of it with zero human touch, then the fleet decides what's worth a person's attention. Hover a stage or an agent to see where it acts.
FOR EVERY ~4,900 SIGNALS WE TAKE IN, ONE BECOMES A CASE. That collapse — 159 : 1 at the alert gate, then 31 : 1 into cases — is the entire point.
How these were counted: every figure on this page is a point-in-time snapshot of our own production instance, verified against the production database on 18 July 2026 — not a live feed, and not a projection of what your deployment will produce. Your collapse ratio depends on your sources, your org profile and your autonomy settings. All figures are cumulative to date on that deployment, not a daily rate. Raw signals = every record in the shared corpus (articles + IOCs + Telegram posts + CVEs + ransomware victims + phishing candidates). Auto-enriched = share of articles carrying both a classification and an embedding, written entirely by the pipeline. Alerts and cases are scoped to this organisation; agent action counts come from the action ledger.
§ 02THE SIX-AGENT FLEET
Three gate the flow; three produce intelligence around it. Hover any card to see where it sits in the funnel.
Every 15 minutes it reads the freshly-enriched intel and surfaces what changed and what matters to your org — then raises an alert on anything critical.
For you: You stop babysitting the feeds. Watch is the reason an alert exists at all.
Puts a verdict — investigate / dismiss / needs-review — and a confidence score on every single alert before you see it, with the reasoning attached.
For you: You validate a judgement instead of triaging from zero — every alert arrives with a verdict, a confidence score and the reasoning attached. On our deployment it dismissed ~6% outright as noise.
Takes an open case and triages it, pulls in enrichment, and writes a recommended verdict — so the case arrives worked, not blank.
For you: Cases open with an AI analysis already attached — 92% of them on our deployment. Grant it act and it closes false positives and escalates confirmed threats itself.
Forms hypotheses, finds the gaps in your detection coverage, and explains anomalies — the questions nobody had time to ask.
For you: Turns idle capacity into proactive discovery, feeding fresh leads back upstream into the funnel.
Drafts campaign briefs and developing-story write-ups, and runs an internal Red Pen adversarial pass on itself before anything reaches you.
For you: A first draft — already self-critiqued — instead of a blank document. You edit and issue.
The copilot you talk to. Ask “is this actor linked to that malware?” and it runs up to 13 read-only tools across the graph and shows its work.
For you: Minutes of pivoting across tables collapse into one plain-language question — and it cites every step.
§ 03WHERE THE HOURS GO
§ 04THE GUARDRAIL
Every agent sits on a three-rung ladder. An org sets how far each may climb, and the registry caps some agents so they can never touch state no matter the setting. Nothing acts on its own until you've decided it's earned it.
Reads and reports. Never changes anything.
Records a recommendation with its confidence and evidence. A human executes.
May use its own bounded powers — and only after per-engine calibration + evidence gates pass.
The result: agents do the grunt work — the reading, the triage, the first-pass enrichment — and humans keep every decision that changes state. Leave them on suggest and you get all the thinking with none of the surprises. Either way, the copilot flies; you keep the yoke.
//RUN THE FUNNEL