Cyware vs D3 Security (Morpheus) (2026)

More than 400 integrations connect the platform, and agents take direct action through existing security tools over MCP server connections. Cyware Orchestrate carries out app actions across the connected stack, and Cyware counts more than 10 million mitigation actions.

Sourcecyware.comread 2026-09-28

There are 800+ self-healing integrations across SIEM, EDR, IAM, cloud, email, NDR and DLP, with response actions run through playbooks and integration commands that sign in to outside systems and act there. Named connections include Microsoft, CrowdStrike, SentinelOne, Splunk, LogRhythm, Elastic, Fortinet, Okta, Zscaler and Recorded Future. When a connector drifts it repairs itself, with an 18 minute mean time to recover that D3 sets against weeks for manual fixes, and a command details panel shows each integration's commands and sample data.

SourceD3 Security, d3security.com/morpheus and docs.d3security.com Morpheus releasesread 2026-10-05

Cyware Orchestrate runs node based playbooks the customer builds, with an LLM assisted Playbook Builder Agent and a Custom Code Generator. Orchestration playbooks run with bounded autonomy and guardrails the customer defines.

Sourcetechdocs.cyware.com/conextgen/en/playbooks.htmlread 2026-09-28

Response playbooks are generated at runtime for each incident, and adaptive playbooks are built from the chat interface with Approval blocks. Customers also build their own playbooks in the platform's SOAR engine, set to start when a case escalates or when data is ingested. Adaptive playbooks combine Morpheus Agent, Router, Parallel, Send Email and Approval blocks, and an investigation playbook can be run from the incident chat. An Agentic Task capability puts bounded LLM reasoning inside a playbook step, and legacy SOAR playbooks keep working during a migration.

SourceD3 Security, docs.d3security.com Morpheus releases and d3security.com/morpheusread 2026-10-05

Intelligence is ingested, enriched, scored and acted on automatically as it arrives, and Orchestrate playbooks fire on their own when alerts and intelligence come in. The DRP Triage Agent prioritizes incoming alerts.

Sourcecyware.comread 2026-09-28

The moment an alert lands, the investigation engine assembles the attack-path story, and playbooks run on ingestion or escalation, so work starts with no one asking. Every alert is triaged, so none is closed silently, and analysts can also launch an investigation playbook from the incident chat.

SourceD3 Security, d3security.com/morpheus and docs.d3security.com Morpheus releasesread 2026-10-05

Cyware Intel Exchange ingests, enriches, scores and relates threat intelligence into a maintained repository that the agents query through CQL search, threat data objects and enrichment metadata. It is a persistent store of the customer's own intelligence.

Sourcecyware.com/blog/talk-to-your-threat-intelligence-platform-introducing-the-cyware-mcp-serverread 2026-09-28

The Cybersecurity Triage Reasoning Graph encodes senior analyst reasoning built by D3's specialists. It holds D3's own security knowledge, not a map of the customer's systems.

Attack Path Discovery assembles evidence across the customer's EDR, identity, email, cloud and network sources for each alert, and D3 publishes no way for a customer to load its own material for Morpheus to search. D3 says the graph took 24 months and 60 specialists to build.

Linked incident search finds related cases by severity, status, type, owner, tags, tactic, technique or creation date, and global lists can be edited in bulk as JSON.

SourceD3 Security, d3security.com/morpheus and docs.d3security.com Morpheus releasesread 2026-10-05

Agents connect to the deployment with no local data storage. Outside the threat intelligence repository, agents have no memory with a set scope and lifetime.

Sourcecyware.com/blog/cyware-ai-agent-ecosystem-deep-dive-operational-impactread 2026-09-28

Since release 18.4, Morpheus reviews how an incident was handled and converts the workflow into a reusable SOP skill, a stored artifact carried forward. D3 does not say who can use an SOP skill or how long one is kept. Case files hold the record of each incident. Analysts or Morpheus itself can then run an SOP skill on later incidents that look alike.

SourceD3 Security, docs.d3security.com Morpheus releasesread 2026-10-05

Customers define approval workflows, autonomy levels and governance policies, so agents only perform authorized actions, and every action is authorized and logged. The customer places the approval step before agent actions. How these workflows work is not published.

Sourcecyware.com/quarterback-airead 2026-09-28

There are four autonomy modes (Deterministic, AI-Assisted, AI-Led, Autonomous), command-risk tagging sets the approval gate for response actions, and adaptive playbooks start from a plan for analyst approval with an Approval block type, so approval comes before the action commits. In AI-Assisted mode an analyst approves every action, in AI-Led mode the analyst oversees command risk tiers, and Autonomous mode keeps approval gates that can be set per workflow, per tenant or per regulator. Attack Path Discovery is read only and takes no action on its own.

SourceD3 Security, d3security.com/morpheusread 2026-10-05

A SOC 2 Type 2 report and ISO 27001:2022 certification from Coalfire are in place, and the FedRAMP Marketplace lists Cyware Cyber Fusion Center as Legacy FedRAMP Ready at Moderate. Agents act only on authorized actions, but there is no published console SSO, role model or permission reference.

Sourcecyware.com/complianceread 2026-09-28

D3 Security is SOC 2 Type II certified, and the platform has access controls with roles and groups carrying permissions, sites for business-unit separation and multi-tenancy. D3 is a member of the Microsoft Intelligent Security Association, and the platform aligns with MITRE ATT&CK and D3FEND. Named user licenses come with every subscription, and multi tenant deployments keep each client's data, configuration and views apart.

SourceD3 Security, docs.d3security.com user docs and d3security.com/resources/faqread 2026-10-05

Playbook run logs show every node's inputs and outputs, execution status, run time and errors with debug information. Agent actions are fully audit logged with tenant isolation, giving a record of each step the automation takes. MTTD and MTTR are reported across the estate.

Sourcetechdocs.cyware.com/conextgen/en/run-logs.htmlread 2026-09-28

Each incident has one unified audit trail of every action, decision and task across all six capabilities, with a complete evidence chain for every investigation, so each investigation keeps its own run record. The trail uses the same format across every capability and autonomy mode, and every element of an attack path comes from a real tool query that is timestamped and attributed. D3 positions the trail for review under SEC, NYDFS, HIPAA, NERC CIP, NIS2, DORA and the EU AI Act, and a utility command retrieves attack path results with their AI summaries.

SourceD3 Security, d3security.com/morpheus and docs.d3security.com Morpheus releasesread 2026-10-05

Deployment can be cloud, on premises or air gapped, with staging environments too, and the deployment model feeds into the quote.

Sourcecyware.com/pricingread 2026-09-28

The platform is hosted on Microsoft Azure across named geographies (US, Canada, EU, UK, APAC, Gulf, Nordics) with data residency configurations, and cloud, on-premise, hybrid and air-gapped deployments are supported. Azure regions include the United States, Canada, Ireland for the EU and Japan, and the residency configurations address GDPR, EU data sovereignty and regional government mandates. MSSPs get a native multi tenant architecture with isolated client data, per tenant configuration and segregated client views.

SourceD3 Security, d3security.com/resources/faq and /morpheusread 2026-10-05

The Agent Hub offers named prebuilt agents with stated jobs, including Threat Intel Research, Vulnerability Exposure Analysis, DRP Triage, Threat Briefing, Priority Intelligence Requirement, Vulnerability Triage, Security Advisory, Detection Engineering and Attack Flow Intelligence, plus a Playbook Store.

Sourcecyware.com/airead 2026-09-28

Morpheus ships one reasoning engine with six named capabilities and generates playbooks at runtime, and SOP skills are derived from the customer's own incidents. There is no catalog of named prebuilt agents or templates. The six capabilities are triage, investigation, response and orchestration, self healing integrations, agentic tasks and autonomy modes, all in one subscription priced as a fixed annual fee by daily alert volume, from 500 to 10,000 alerts a day with custom tiers above, plus named user licenses.

SourceD3 Security, d3security.com/morpheus and /resources/faqread 2026-10-05

The models behind Cyware's agents are not named, and customers get no choice of provider. LLMs run in playbooks, and MCP support lets outside assistants reach Cyware, but neither lets the customer choose a model.

Sourcecyware.com/airead 2026-09-28

Morpheus also supports customer-preferred LLMs for organizations that require it, without changing the pricing structure, so a customer can bring its own model, and the default models are not named. The Agentic Task capability is provider agnostic and runs through D3's built in connector or the customer's existing AI vendor contract. D3 absorbs all token and inference costs within the subscription, and the Triage Reasoning Graph is included at no extra cost.

SourceD3 Security, d3security.com/resources/faq and /morpheusread 2026-10-05

The open source Cyware MCP Server (github.com/cyware-labs/cyware-mcpserver) comes with install steps, a choice of transport (stdio or SSE), authentication with Cyware application credentials and a full tool list for Intel Exchange and Orchestrate. Its tools include creating intel, tags and bulk actions and running playbooks and app actions. A playbook API sits at orchestrateapi.cyware.com.

Sourcegithub.com/cyware-labs/cyware-mcpserverread 2026-09-28

The D3 Command API (API key or JWT auth, POST endpoints for Incidents, Events, Playbooks, Artifacts, Files, Users, Sites and GlobalLists) comes with utility command docs, and there is no MCP server. Release 18.4 lets teams organize custom utility commands in nested folders and filter command search by connection, and it added a command that returns attack path results.

SourceD3 Security, docs.d3security.com API docs and Morpheus releasesread 2026-10-05

Run logs give node level debug information with error summaries and remediation steps, and an AI Playbook Runlog Debugger analyzes failed runs. There is no harness, scored test case or quality gate for the agents.

Sourcetechdocs.cyware.com/conextgen/en/run-logs.htmlread 2026-09-28

D3 tests Morpheus against simulated attacks and adversarial inputs as part of its own release work and publishes revelation and closure rates. Customers get no published way to test Morpheus on their own deployment. D3's own figure is that up to 95 percent of alerts are triaged and investigated to L2 depth in under two minutes.

SourceD3 Security, d3security.com/morpheusread 2026-10-05

The Agent Hub is also delivered as a Chrome and Edge extension. That is where the product runs, and no agent operates the browser. The agents connect back to the Cyware deployment by API.

Sourcecyware.com/blog/cyware-ai-agent-ecosystem-deep-dive-operational-impactread 2026-09-28

There is no browser or computer use by Morpheus, which acts through integrations and commands. Attack Path Discovery queries the connected tools through their APIs and stays read only.

SourceD3 Security, d3security.com/morpheusread 2026-10-05