Kaspersky Updates Threat Intelligence Portal with AI Features and MCP Support

Kaspersky has announced an update to its Threat Intelligence Portal, introducing new AI features including automated summarization and support for the Model Context Protocol (MCP). The update aims to accelerate and simplify the daily operations of security operations center teams and cyber threat analysts. These features enable full utilization of the platform, which relies on more than 25 petabytes of proprietary data linked to threat context.

Drivers of the Update and Challenges Addressed

Modern security operations centers face an accumulation of thousands of daily alerts and staff shortages, while the time attackers need to compromise systems is decreasing noticeably. As the cyber race intensifies with AI, security teams often lack the time and expertise required to manually classify complex technical logs or develop custom API integration solutions.

To enable defense and security teams to achieve the desired speed and productivity, Kaspersky has integrated AI features into its leading threat intelligence portfolio. The update expands the platform's capabilities along two practical tracks: helping analysts process and absorb massive amounts of easily readable threat data very quickly, and making these services available to third-party AI applications.

AI Summarization for Easily Readable Threat Information

Analysts often have to review hundreds of indicators of compromise (IoCs) and lengthy, complex reports during ongoing investigations, threat tracking, and pursuit of threat actors or campaigns. The AI summarization feature addresses this problem by condensing massive amounts of easily readable data into short, clear summaries with one click.

The summarization feature significantly reduces the volume of information that requires human review for each indicator, helping analysts identify items that need deeper investigation in a short time. The tool automatically processes available information so analysts can identify useful content such as indicators of compromise and rules. Thanks to these short summaries, less experienced analysts can handle threat data more easily, while the workload on highly skilled staff is reduced.

Kaspersky selected the source dataset that feeds the summary in each section of the summary. This procedure shortens review time without sacrificing the context analysts rely on to evaluate the information presented.

AI summarization and search capabilities for indicators of compromise (IoCs) are also available through open-source threat intelligence (OSINT) searches. Analysts use this feature to examine all data related to a specific entity, prioritize, and gain a comprehensive view of the most important information and data. Customers also gain a broader view of potential risks thanks to automated intelligent searches across open-source information (OSINT).

Model Context Protocol Support for Integration with External AI Applications

MCP integration allows organizations to connect their AI applications, or third-party applications, to the Kaspersky Threat Intelligence Portal. Unlike rigid traditional APIs, the MCP connection is designed to enable AI models to perform flexible, dynamic queries and facilitate their access to external threat data at the appropriate time and in the appropriate manner.

This integration gives AI applications immediate access to the global threat intelligence data provided by Kaspersky, resulting in automated, smarter workflows and highly flexible threat analysis.

Kaspersky Statements and Availability Details

Alexander Mazikin, Head of the Cyber Threat Intelligence Product Line at Kaspersky, commented: "The Kaspersky Threat Intelligence portfolio has long been highly praised for the outstanding quality of its data and comprehensive coverage. For nearly 30 years, we have built a solid foundation of high-quality threat intelligence data and have made great use of AI and machine learning to collect and classify threat data.

Today we focus on making the full potential of this data available to all our customers. The key feature we provide through AI is reducing the time between receiving information and understanding how to act on it. Ultimately, these capabilities will double the efficiency of organizations' investments in threat intelligence, saving teams hours of complex analysis and significantly increasing the accuracy of security operations."

Customers can immediately benefit from the new AI features through their existing Kaspersky Threat Lookup license, which grants them a specific quota of requests and queries. Organizations requiring a larger quota can increase capacity and purchase additional requests as needed.

Additional details are available on the official Threat Intelligence Portal page.