Kaspersky has upgraded its Threat Intelligence Portal with built-in AI summarization and Model Context Protocol (MCP) support, aiming to streamline daily operations for security operations center (SOC) teams and threat analysts.

The update comes as modern SOCs face thousands of daily alerts and ongoing staffing shortages, even as attacker breakout times rapidly shrink.

With AI accelerating cyber threats, security personnel frequently struggle to find the time or technical expertise needed to manually classify logs or construct custom API integrations.

To address these speed and productivity bottlenecks, Kaspersky added practical AI tools that draw on its database of more than 25 petabytes of proprietary threat context. The latest enhancements focus on two main areas:

• AI summarization for threat reports: Analysts tracking threat actors, hunting threats, or evaluating hundreds of Indicators of Compromise (IoCs) can now generate short, clear summaries with a single click. By condensing extensive human-readable data, the feature helps staff determine within minutes which items require deeper review. Kaspersky selects specific source datasets for each summary block to cut down review times while preserving essential context.
• Open-source intelligence (OSINT) processing: AI-driven summarization and smart searches extend to IoCs found via OSINT. This allows analysts to examine, prioritize, and review all external data tied to a specific entity from a single overview.
• Model Context Protocol (MCP) connectivity: Organizations can now link their proprietary or third-party AI applications directly to the Kaspersky Threat Intelligence Portal. Built for dynamic queries rather than rigid traditional API structures, MCP gives corporate AI tools real-time access to Kaspersky’s global intelligence for automated workflows.

“The primary opportunity we bring with new AI features is to reduce the time between receiving information and understanding how to act on it. Ultimately, these capabilities will maximize the efficiency of corporate threat intelligence investments, saving teams hours of complex analysis and significantly enhancing the accuracy of security workflows,” says Alexander Mazikin, Head of Threat Intelligence Product Line at Kaspersky.

Organizations with an active Kaspersky Threat Lookup license can access the new AI capabilities immediately using their standard request quota, with options to purchase additional request capacity on demand.

More details are available on Threat Intelligence Portal page.