EclecticIQ brings AI to cyber threat investigations

Amsterdam-based EclecticIQ builds software that helps security teams collect, investigate and share information about cyber threats. Through its Intelligence Center, the company is adding AI to analysts’ daily work, from searching reports to recording findings. Founded in 2014, it serves both government organisations and large enterprises.

That work often begins with a collection of separate clues. A suspicious internet address, a report on a threat actor group or a description of malware becomes more meaningful when an analyst can investigate the connections. Intelligence Center provides a shared environment for this work. Its AI features help analysts read, organise and process information. With version 3.8, announced in August 2026, AI agents can also gain access to that environment.

From lengthy reports to useful findings

Reading is a substantial part of threat research. Analysts extract relevant details from reports, connect them to existing knowledge and make their findings understandable to colleagues. EclecticIQ incorporates AI at several points in that process. Its AI Assistant can summarise information and highlight important details. Automated extraction helps identify threat actor groups, malware and attack patterns in unstructured text and link them to existing information.

The company expanded these capabilities in version 3.6. Analysts can summarise information from search results and visual representations of connections, translate text and add the results to reports or notes. The platform also offers customisable report templates and an editor where teams can develop their findings. This connects the AI features to a tangible outcome of research, a report that other people can use.

Choosing where the language model runs

Organisations have different requirements for processing their data. EclecticIQ lets customers choose which large language model they use and where it runs. With Bring Your Own LLM, they can host a model on their own infrastructure or run it in an environment managed by EclecticIQ for their organisation. They can also select a suitable model for each AI feature.

That choice involves data management, costs and how well a model suits a particular task. An organisation might value multilingual processing, for example, or a model suited to its field. Version 3.8 adds Amazon Bedrock as a supported provider. This gives teams another option when they want to run their AI workloads within an AWS environment they already use.

One platform for different workflows

Intelligence Center users work in a variety of settings. EclecticIQ describes, for example, how an international bank uses the platform to assess threat intelligence and support collaboration across its locations. The company also develops features for public sector organisations, including defence and national security.

Since March 2026, Intelligence Center has offered a configurable Defense TIP capability for these users. It aligns elements such as terminology, classifications and reporting with defence organisations’ workflows and standards. Analysts have access to templates for intelligence summaries and threat assessments, for example. They can also combine cyber information with other types of intelligence. The capability sits within Intelligence Center and is designed to produce information in formats that defence organisations and their partners can use.

AI agents gain access to the research environment

In July 2026, EclecticIQ introduced its MCP Server. MCP is an open protocol that connects AI applications to other systems. The integration gives compatible AI agents access to Intelligence Center, allowing them to look up information, enrich data and record objects and the relationships between them.

An analyst can therefore have findings from an AI-assisted investigation recorded in the shared platform. Across successive releases, EclecticIQ is incorporating AI into different stages of the work, from examining reports to sharing findings within a team.