Cyware
Cyware sells Orchestrate, a low-code automation product for playbooks across SIEM, EDR and other tools, beside a threat intelligence platform. It places second of 14 at 6.11, with 17 of 25 containment actions documented. It publishes a 400+ integration count and mobile approvals, but no time-to-contain figure and no price.
What Cyware is
Orchestrate is a low-code and no-code playbook builder with AI help for writing and debugging playbooks. It runs in the cloud and on premises, and it lists 150-plus playbook templates (cyware.com/products/orchestrate, read 2026-11-03, vendor claim).
Playbooks can start from SIEM alerts, threat intelligence feeds or other events, or run manually, on a schedule or through the API. The page also lists SLA tracking, playbook version control and a mobile app for approving automated actions. It does not use the word containment.
Cyware sells a threat intelligence platform and Cyware Orchestrate, a low-code security automation product that builds playbooks across SIEM, EDR and other tools. Its intelligence products and its Orchestrate product are sold as separate modules. cyware.com, read
Products named: Cyware Orchestrate, Cyware Intelligence Suite, Cyware Respond, Cyware Quarterback AI (AI Fabric).
Ownership. One deal aggregator (Signalbase) lists Cyware as 'acquired by Microsoft' on 2025-10-14, undisclosed amount. No Microsoft or Cyware release confirms it. Partnership coverage from 2025-10-22 describes a partnership and product integrations, not an acquisition. Treat ownership as independent until a primary source says otherwise. trysignalbase.com, read
no figureon the pages read
Published time to contain
No figure on time to contain, or on any adjacent response metric, was found for Cyware on the pages read. Page speaks of workflows built in minutes; no containment figure.
17 of 255 of 5 domains
Containment coverage
Of 25 containment actions across EDR, identity, email, cloud and network, Cyware documents 17 as native or partner on the pages read: 17 native, 0 partner, 0 custom step only, 8 not documented. Coverage share is 68 percent.
- native, vendor-documented
- partner or third-party documented
- custom step only
- not documented on the pages read
| Platform | EDR | Identity | Cloud | Network | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Isolate host | Release isolation | Kill process | Quarantine file | Run script or live response | Block hash | Disable user | Force password reset | Revoke sessions or tokens | Require MFA re-enrolment | Remove from group or role | Delete a delivered message | Quarantine a delivered message | Block sender or domain | Remove a URL rewrite exemption | Pull from quarantine | Disable IAM user or access key | Revoke cloud session | Isolate or stop an instance | Change a security group or firewall rule | Revoke OAuth app consent | Block IP or domain at the firewall | Block at the proxy or DNS filter | Disable a switch port or NAC quarantine | Add to a threat list on the NDR | |
| Cyware17 of 25 documented | Cyware: Kill process, not documented | Cyware: Quarantine a delivered message, not documented | Cyware: Remove a URL rewrite exemption, not documented | Cyware: Revoke cloud session, not documented | Cyware: Isolate or stop an instance, not documented | Cyware: Change a security group or firewall rule, not documented | Cyware: Revoke OAuth app consent, not documented | Cyware: Disable a switch port or NAC quarantine, not documented | |||||||||||||||||
Basis: Cyware Technical Documentation: Orchestrate integration pages and their versioned subpages. Integrations are Cyware-built, read as native. Read 2026-11-04.
Limits: Some integration pages (EC2, Exchange, Office 365) carried no action text; integrations placed in odd categories (Okta under Network Security).
The full grid, with the page behind each cell, is on the scorecard. A cell reads not documented when the pages read did not show the action. That is a finding about public material, not a claim that the action is absent.
6.11rank 2 of 14
Rubric scores
Cyware is in a band with Google Security Operations (6.09), Palo Alto Cortex XSOAR (5.91), Swimlane (Turbine) (5.84), Splunk SOAR (Cisco) (5.79), Torq (5.74), Tines (5.62). A band is a run of neighbouring totals. Bands chain: a new band starts only where the gap to the total above exceeds 0.25, so a band can be wider than 0.25 and the order inside it is not an order.
| Criterion | Weight | Score | Points | Status, reason and source |
|---|---|---|---|---|
| Native containment coverage | 25 | 7.1 | 1.775 | documented. 17 of 25 containment actions documented as native or partner (68 percent) across 5 of 5 domains. Score is 2.0 plus 7.5 times the share, capped at 9.5. |
| Published time-to-contain evidence with method | 15 | 4.0 | 0.600 | not documented. Page claims "manual security tasks" cut by 80 percent with no method; no containment time given. vendor claim cyware.com, read |
| Approval, rollback and blast-radius controls documented | 15 | 6.5 | 0.975 | partial. Page states approvals through a mobile app for "critical automation decisions" and rollback of workflows to previous versions; action rollback and scope limits are not stated. vendor claim cyware.com, read |
| Explanation and audit trail | 15 | 6.0 | 0.900 | partial. Page says "complete audit trails" for playbook changes and refers to activity logs; record contents not described. vendor claim cyware.com, read |
| Integration depth documented | 10 | 8.0 | 0.800 | documented. Page states "400+ Tool Integrations" and "10 Million+ Actions Taken for Threat Mitigation" (an unmethodised vendor claim). vendor claim cyware.com, read |
| Detection-to-response coupling | 8 | 6.5 | 0.520 | partial. Playbooks can trigger on "SIEM alerts, threat intelligence feeds, and security events"; ingestion mechanics are not detailed. cyware.com, read |
| Pricing transparency | 6 | 3.0 | 0.180 | not documented. No price; the page links to a pricing page that shows none. cyware.com, read |
| Deployment and data handling | 6 | 6.0 | 0.360 | partial. Hybrid deployment through lightweight agents and a SOC 2 Type 2 logo; residency and retention not stated. vendor claim cyware.com, read |
| Total | 100 | 6.11 | Sum of the eight weighted points above, to two decimals. | |
Scores are proposals under the rubric bands, computed in code from the published weights. Where a score rests on a vendor's marketing page only, a read of its documentation can move it.
Where Cyware is strong
- Vendor claim: approvals for critical automation decisions can run through a mobile app, and playbooks can be rolled back to a previous version. The second control covers workflows, not executed actions. cyware.com, read
- Vendor claim: the page states 400+ tool integrations, a public count. It also claims 10 million-plus actions taken for threat mitigation, a figure with no stated basis. cyware.com, read
- Vendor claim: playbooks can trigger on SIEM alerts, threat intelligence feeds and security events, and the page lists phishing response among its templates. Ingestion mechanics are not detailed. cyware.com, read
Where Cyware is behind
- Time-to-contain evidence: none. The page claims manual security tasks cut by 80 percent through automated workflows, with no data behind it, and gives no containment time. Its response language is general, such as reduce response times. cyware.com, read
- Approval is stated for critical decisions through a mobile app, but approval tiers, action rollback and scope limits are not. Audit is stated as complete audit trails for playbook changes, without record contents. cyware.com, read
- No price or unit is published; the pricing page says cost is scoped per engagement. The integrations page returned HTTP 404 on 2026-11-03, so the 400+ count cannot be checked against a list. cyware.com, read
What only Cyware has
Cyware sells Orchestrate as a module beside its threat intelligence products, and its own page says the intelligence and automation modules are sold separately. cyware.com, read
nonelisted
Pricing as published
vendor claim Not published. The pricing page says cost is scoped per engagement by deployment model, analyst seats, intelligence feeds, automation volume, sandbox capacity, digital risk protection and add-ons. cyware.com, read
Trial or free tier. Orchestrate page links to a demo request. No trial terms stated. cyware.com, read
Integrations. 400 published as a count; named: SIEM tools, EDR tools, SOAR tools. vendor claim cyware.com, read
2names on its pages
Named customers
Customers below are names on Cyware's own pages, so each is a vendor claim. A logo is not a reference, and none of these entries says what the customer uses the product for.
- MTS-ISAC, Quilter. cyware.com, read
3dated entries
Recent releases
| Date | Release | Source |
|---|---|---|
| 2025-10-22 | Strategic partnership with Microsoft for product integrations; Sentinel ingests Cyware threat intelligence; solutions in Microsoft Commercial Marketplace. Partnership and integrations, not an acquisition, per Channel Insider. | channelinsider.com, read |
| 2025-11-12 | Quarterback AI upgraded to an AI Fabric of generative, agentic and in-product AI. Cyware describes the upgrade as speeding up threat intelligence and security operations work, including playbook creation, threat data collection, and detection and response. | vendor claim cyware.com, read |
| 2026-03-18 | Agentic AI Fabric launch with agent catalogue (Attack Flow Agent maps activity to ATT&CK). Reported in a search summary of the BusinessWire release; the release page returned HTTP 403 to fetch. | vendor claim businesswire.com, read |
5graded
Claims Cyware makes about itself
Each is a vendor claim, graded A to D on the method published: A independent with method, B vendor-measured with sample and method, C a number with no method, D unverifiable. This site's own voice does not repeat any of them as fact.
| Claim | Method stated | Grade | Source |
|---|---|---|---|
| Orchestrate reduces manual security tasks by 80 percent through automated workflows | not stated. Measured by unknown. | D | vendor claim cyware.com, read |
| Orchestrate accelerates tool integration by 19x | not stated. Measured by unknown. | D | vendor claim cyware.com, read |
| 10 million plus threats mitigated through automated actioning | not stated. Measured by vendor. | C | vendor claim cyware.com, read |
| 15 billion plus threat intelligence objects turned into actionable insights | not stated. Measured by vendor. | C | vendor claim cyware.com, read |
| 85 percent of major ISACs trust Cyware for collective defense | not described. Measured by unknown. | D | vendor claim cyware.com, read |
Who should shortlist Cyware
- You want threat intelligence and orchestration from one vendor and will buy the modules separately.
- You need mobile sign-off for automated actions from approvers who are away from a console.
- You want a library of playbook templates to adapt, and accept that actions must be checked in a pilot.
Cyware places 2nd of 14 at a total of 6.11, with 17 of 25 containment actions documented. The strongest total below D3 Security, on 17 of 25 documented containment actions, a 400+ integration count and mobile approvals. It sits in a band of seven with Google Security Operations, Palo Alto Cortex XSOAR, Swimlane, Splunk SOAR, Torq and Tines, so the order inside it is not settled by the evidence. Neither a time to contain nor a price is published.
The same platform under other weights
- Regulated financial: 3rd of 14, total 6.19.
- Lean team: 3rd of 14, total 5.94.
- MSSP: 2nd of 14, total 6.20.
- Microsoft estate: 3rd of 14, total 6.09.
- CrowdStrike estate: 3rd of 14, total 6.18.
Compare Cyware
- Cyware alternatives: 3 gaps and 5 platforms that answer them.
- Cyware against Google Security Operations, totals 6.11 and 6.09.
- Cyware against Palo Alto Cortex XSOAR, totals 6.11 and 5.91.
- Cyware against Swimlane (Turbine), totals 6.11 and 5.84.
- Cyware against Splunk SOAR (Cisco), totals 6.11 and 5.79.
Facts on this page were read 2026-11-04 and the days before it; the date beside each source is the date it was read. Last updated 4 November 2026.