Skip to main content

​
What is Mallory?

Mallory is an AI-native Threat & Exposure Management platform. It correlates threat intelligence against your internal and external attack surface, so your team acts on what matters first instead of reacting to everything. Mallory works in three steps:
  • Aggregate. Mallory collects from thousands of sources of threat intelligence, OSINT, dark web, social monitoring, and external attack surface data. It adds intelligence it generates itself, such as sandbox execution and internet scanning. Every record is deduplicated and resolved into entities as it arrives.
  • Correlate. The Intelligence Graph connects actors, campaigns, vulnerabilities, products, and observables. When you connect your asset inventory, Mallory reads the two together, so “this CVE is being exploited” becomes “this CVE is being exploited on hosts you own.”
  • Act. The Mallory agent proposes prioritized findings and routed work from correlated intelligence, ranked by what adversaries are doing today rather than by a severity score alone. You can see, question, and override every step.
Mallory runs on the AI you already use and writes into the tools you already run: cloud, identity, vulnerability management, ticketing, chat, SIEM, and SOAR.

​
Who it’s for

  • CTI analysts triage what’s relevant to their environment instead of skimming everything published that day.
  • Exposure and vulnerability management teams fix what’s exploitable and reachable first.
  • Threat hunters and red teamers start from adversary TTPs mapped to the assets an adversary can actually reach.
  • Detection engineers find detection gaps against live campaigns and the TTPs behind them.
  • Security operations teams route prioritized work into the SIEM, SOAR, and ticketing tools they already use.

​
Core capabilities

The Feed

Intelligence stories updated by the minute, tuned to what you track.

Threads

Investigate with the Mallory agent in natural language.

Intel

Browse threat actors, malware, vulnerabilities, organizations, and products.

Observables

IOCs and observable activity tied to entities.

Findings

Track security issues on specific assets, with evidence and linked tickets.

Integrations

Connect your asset inventory, models, and security tools.

​
Next steps

Quickstart

Get to your first value in a few steps.

Key concepts

Learn how sources, references, entities, indicators, stories, and the feed fit together.