Kaspersky adds AI summarisation and MCP to threat intelligence
Kaspersky has rolled out a substantive update to its Threat Intelligence Portal, embedding AI-assisted summarisation and Model Context Protocol (MCP) connectivity into the platform. The update is aimed at security operations centre (SOC) teams and threat analysts who face mounting alert volumes with limited headcount, and is available immediately to existing Threat Lookup licence holders.
The company says the portal draws on more than 25 petabytes of proprietary threat context accumulated over nearly three decades of security research.
What the update delivers
The headline addition is a one-click AI summarisation feature that condenses large sets of indicators of compromise (IoCs) and lengthy threat reports into concise, structured overviews. Kaspersky says this is intended to cut the time analysts spend triaging each indicator, allowing faster triage decisions and freeing senior staff from repetitive review work. Summarisation is also available for IoCs surfaced through automated open-source intelligence (OSINT) searches, giving analysts a consolidated view of externally visible threat data alongside Kaspersky's proprietary feeds.
The second addition is MCP support, which enables organisations to connect their own AI applications, or third-party tools, directly to the portal's data layer. MCP is a standardised protocol designed to allow AI models to issue flexible, context-driven queries rather than relying on fixed API call structures. Kaspersky positions this as a step toward agentic security workflows, where AI-driven systems can pull live threat data on demand rather than waiting for scheduled feed updates.
Alexander Mazikin, Head of Threat Intelligence Product Line at Kaspersky, said the company's goal is "to reduce the time between receiving information and understanding how to act on it," adding that the features are designed to "save teams hours of complex analysis and significantly enhancing the accuracy of security workflows."
Market context
The threat intelligence platform market is increasingly competitive, with vendors including Recorded Future, Mandiant (now part of Google Cloud), Microsoft Sentinel and CrowdStrike Falcon Intelligence all expanding their AI-assisted analysis capabilities. The pressure on SOC teams is well-documented: analyst burnout, high false-positive rates and shrinking attacker dwell times have pushed vendors to automate more of the triage and contextualisation layer.
MCP adoption is a notable strategic signal. The protocol, originally developed to standardise how large language models interact with external data sources, has seen rapid uptake across the enterprise software ecosystem in 2025 and 2026. By exposing its threat intelligence layer via MCP, Kaspersky is positioning its data as a connectable resource for the growing number of AI security co-pilots and autonomous investigation tools entering enterprise environments.
Kaspersky's broader market position remains complicated in certain geographies. The company continues to operate under a US Federal Communications Commission designation that restricts its software from being used in US federal networks, a constraint that limits its addressable enterprise market in North America. European and Asia-Pacific customers represent the primary commercial focus for new product launches of this kind.
The new features are included within the standard Threat Lookup licence quota, with additional request capacity available as a paid add-on for higher-volume users. Kaspersky did not disclose pricing for the scaled-volume tier.