Cyware vs Swimlane (2026)

More than 400 integrations connect the platform, and agents take direct action through existing security tools over MCP server connections. Cyware Orchestrate carries out app actions across the connected stack, and Cyware counts more than 10 million mitigation actions.

Sourcecyware.comread 2026-09-28

The Swimlane Marketplace has connectors for Microsoft, AWS, Cisco, CrowdStrike, Palo Alto Networks and others. An Ingestion Agent integrates with any API instantly, and playbooks act across the connected stack after approval. Turbine has connectors for more than 30 vendors, Splunk among them, and every plan includes unlimited integrations. The Threat Intelligence Agent pulls together sources such as VirusTotal and Recorded Future. Hero AI tools reach the connected stack through an MCP server that calls the Turbine engine.

SourceSwimlane, swimlane.com/swimlane-turbine, /platform/enterprise-packaging and swimlane.com/news/ai-agents-case-managementread 2026-10-05

Cyware Orchestrate runs node based playbooks the customer builds, with an LLM assisted Playbook Builder Agent and a Custom Code Generator. Orchestration playbooks run with bounded autonomy and guardrails the customer defines.

Sourcetechdocs.cyware.com/conextgen/en/playbooks.htmlread 2026-09-28

Swimlane calls Turbine Canvas the world's first ultra simple playbook and AI agent builder. Customers build playbooks with agents as steps, and they decide how alerts are routed between deterministic playbooks and deep and expert agents. Each alert goes to an existing playbook, an AI assisted investigation or a fully agentic one, depending on how complex it is. Hero AI agents can be dragged into a playbook as steps. In a playbook step, the Hero AI action takes a plain language prompt and decides which of its configured tools to call and when.

SourceSwimlane, swimlane.com/swimlane-turbine, /product/ai-soc and docs.swimlane.com Hero AI Native Actionread 2026-10-05

Intelligence is ingested, enriched, scored and acted on automatically as it arrives, and Orchestrate playbooks fire on their own when alerts and intelligence come in. The DRP Triage Agent prioritizes incoming alerts.

Sourcecyware.comread 2026-09-28

Incoming alerts are routed to playbooks and AI SOC investigations through the Active Sensing Fabric ingestion layer, so work starts on an alert with no person launching it. Routing checks every alert and sends it to a playbook, an AI assisted investigation or a fully agentic one. The 26.4 release added custom dynamic responses to webhooks. Analysts can also start work from Hero AI chat, which finds and runs components marked visible to Hero AI.

SourceSwimlane, swimlane.com/swimlane-turbine, /product/ai-soc and docs.swimlane.com Create and Modify Components with Hero AIread 2026-10-05

Cyware Intel Exchange ingests, enriches, scores and relates threat intelligence into a maintained repository that the agents query through CQL search, threat data objects and enrichment metadata. It is a persistent store of the customer's own intelligence.

Sourcecyware.com/blog/talk-to-your-threat-intelligence-platform-introducing-the-cyware-mcp-serverread 2026-09-28

Deep agents use MCP and methodical reasoning, and the AI SOC collects data for each investigation. The Investigation Agent uses identified threats, past investigations and knowledge base articles to plan an investigation and write the playbooks that carry it out. The Verdict Agent reads current, linked and historical case context, including knowledge base articles, threat intelligence and analyst notes. Swimlane does not say how a customer adds its own articles or how that knowledge store is kept up to date.

SourceSwimlane, swimlane.com/product/ai-soc and swimlane.com/news/ai-agents-case-managementread 2026-10-05

Agents connect to the deployment with no local data storage. Outside the threat intelligence repository, agents have no memory with a set scope and lifetime.

Sourcecyware.com/blog/cyware-ai-agent-ecosystem-deep-dive-operational-impactread 2026-09-28

Case management is the system of record, where case data sits in a set structure. The Verdict Agent and the Investigation Agent read historical cases and past investigations as they work, but Swimlane does not say what an agent keeps between runs, for how long or for whom. Case records count against a yearly allowance, from 100,000 records on the Starter plan to 1 million on Elite.

SourceSwimlane, swimlane.com/product/ai-soc, /platform/ai and /platform/enterprise-packagingread 2026-10-05

Customers define approval workflows, autonomy levels and governance policies, so agents only perform authorized actions, and every action is authorized and logged. The customer places the approval step before agent actions. How these workflows work is not published.

Sourcecyware.com/quarterback-airead 2026-09-28

The AI SOC requires explicit human approval before any state changing action the organization has not already trusted to automation. Analysts can review, change or rebuild any plan the AI writes before it runs, and they can pause, reject or roll back a recommendation at any point. When Hero AI is unsure, it hands the case to a person instead of guessing. In the builder, a component Hero AI drafts stays on the canvas for review until someone saves it.

SourceSwimlane, swimlane.com/product/ai-soc and docs.swimlane.com Create and Modify Components with Hero AIread 2026-10-05

A SOC 2 Type 2 report and ISO 27001:2022 certification from Coalfire are in place, and the FedRAMP Marketplace lists Cyware Cyber Fusion Center as Legacy FedRAMP Ready at Moderate. Agents act only on authorized actions, but there is no published console SSO, role model or permission reference.

Sourcecyware.com/complianceread 2026-09-28

Swimlane Cloud holds SOC 2 Type II, ISO/IEC 27001, 27017, 27018 and 27701 and CSA STAR, with a FedRAMP High GOV region, globally enforced two factor authentication, SAML SSO and role based access down to field level, plus SCIM provisioning and audit logging. It also holds SOC 1 Type II and ISO 9001, and Swimlane cites ISO 42001 and FedRAMP High authorization for Hero AI.

Role based access covers workspaces, dashboards, reports, applications and records, and sign in also works through LDAP and Active Directory. Data is encrypted at rest and in transit, and credentials are kept in a secure database. Only a few employees can reach production systems, and contractors have no access to customer production data.

SourceSwimlane, swimlane.com/solutions/swimlane-cloud and swimlane.com/platform/airead 2026-10-05

Playbook run logs show every node's inputs and outputs, execution status, run time and errors with debug information. Agent actions are fully audit logged with tenant isolation, giving a record of each step the automation takes. MTTD and MTTR are reported across the estate.

Sourcetechdocs.cyware.com/conextgen/en/run-logs.htmlread 2026-09-28

For every investigation, the AI SOC keeps a plain language record of the agent's reasoning, covering what data it collected, what logic it applied and what conclusion it reached, which can be exported for audit. Turbine also keeps audit logs. The Investigation Agent writes a summary and a timeline for each case. Each Hero AI action returns a request ID, a finish reason and token counts along with its result, and dashboards and reports track how the security team is performing.

SourceSwimlane, swimlane.com/product/ai-soc, swimlane.com/news/ai-agents-case-management and docs.swimlane.com Hero AI Native Actionread 2026-10-05

Deployment can be cloud, on premises or air gapped, with staging environments too, and the deployment model feeds into the quote.

Sourcecyware.com/pricingread 2026-09-28

Swimlane runs in the cloud, on premises or air gapped, and Swimlane Cloud is offered in eight regions, the US, UK, EU, Canada, Singapore, Tokyo, Australia and a dedicated FedRAMP High GOV region. The cloud service runs on AWS. In an on premises install, the tools Hero AI calls run inside the customer's own cluster. Setup takes two weeks on the Starter plan and four weeks on the larger plans.

SourceSwimlane, swimlane.com/platform/enterprise-packaging, /swimlane-turbine and docs.swimlane.com Hero AI Native Actionread 2026-10-05

The Agent Hub offers named prebuilt agents with stated jobs, including Threat Intel Research, Vulnerability Exposure Analysis, DRP Triage, Threat Briefing, Priority Intelligence Requirement, Vulnerability Triage, Security Advisory, Detection Engineering and Attack Flow Intelligence, plus a Playbook Store.

Sourcecyware.com/airead 2026-09-28

Hero AI ships named agents (Playbook Generator, Intelligent Visualization, Ingestion) alongside deep and expert agents, and the Swimlane Marketplace carries prebuilt agents, playbooks and connectors that drop into playbooks. Hero AI has seven agents in all, adding Agentic Investigations, Verdict, Threat Intelligence, and MITRE ATT&CK and D3FEND.

The Verdict Agent gives a verdict on a case the way an analyst would, and the MITRE agent maps alerts to standard attack techniques. The Playbook Generator asks clarifying questions as it builds. NIST aligned action recommendations sort each response into containment, eradication, recovery and hardening.

SourceSwimlane, swimlane.com/platform/ai, /product/ai-soc and swimlane.com/news/ai-agents-case-managementread 2026-10-05

The models behind Cyware's agents are not named, and customers get no choice of provider. LLMs run in playbooks, and MCP support lets outside assistants reach Cyware, but neither lets the customer choose a model.

Sourcecyware.com/airead 2026-09-28

Customers select the AI model for each agent, including their own model, based on performance and availability. Any AWS Bedrock model can run a Hero AI agent, and customers can bring their own model from Anthropic and select Bedrock models. The Hero AI playbook action defaults to Claude Haiku 4.5, can switch to Sonnet or Opus models, and also offers OpenAI and Qwen models. Each plan includes a Hero AI credit allowance, from 37,500 credits on Starter to 262,600 on Elite.

SourceSwimlane, swimlane.com/product/ai-soc, /platform/ai, /platform/enterprise-packaging and docs.swimlane.com Hero AI Native Actionread 2026-10-05

The open source Cyware MCP Server (github.com/cyware-labs/cyware-mcpserver) comes with install steps, a choice of transport (stdio or SSE), authentication with Cyware application credentials and a full tool list for Intel Exchange and Orchestrate. Its tools include creating intel, tags and bulk actions and running playbooks and app actions. A playbook API sits at orchestrateapi.cyware.com.

Sourcegithub.com/cyware-labs/cyware-mcpserverread 2026-09-28

The Turbine API uses personal access token authentication and has a generic request action for any endpoint, Turbine Canvas supports full code, and SCIM provisioning is supported. The API connector accepts a username and password or a personal access token, and its request action takes any method and path.

Hero AI actions can return JSON shaped to a schema the builder defines, and the Plus plan and above add an App Builder and a Git repository. Hero AI calls its tools through an MCP server that talks to the Turbine engine, and the deep agents use MCP as clients, but there is no MCP server for outside agents to connect to.

SourceSwimlane, docs.swimlane.com Swimlane Turbine API connector and Hero AI Native Actionread 2026-10-05

Run logs give node level debug information with error summaries and remediation steps, and an AI Playbook Runlog Debugger analyzes failed runs. There is no harness, scored test case or quality gate for the agents.

Sourcetechdocs.cyware.com/conextgen/en/run-logs.htmlread 2026-09-28

There is no way to run agents or playbooks against test cases and score the results. The Playbook Generator writes and changes playbooks from prompts, and it does not test them. Swimlane's accuracy and savings figures come from customer stories, such as 100% recommendation accuracy at one customer and 128 of about 180 daily cases closed at a healthcare customer.

SourceSwimlane, swimlane.com/product/ai-soc and swimlane.com/platform/airead 2026-10-05

The Agent Hub is also delivered as a Chrome and Edge extension. That is where the product runs, and no agent operates the browser. The agents connect back to the Cyware deployment by API.

Sourcecyware.com/blog/cyware-ai-agent-ecosystem-deep-dive-operational-impactread 2026-09-28

Automation acts through API connectors, and no agent operates a browser or desktop. Hero AI works through playbook actions and tools that call the Turbine engine, and the Ingestion Agent reaches new data sources through their APIs. None of these opens a web page or works a screen.

SourceSwimlane, swimlane.com/swimlane-turbine and docs.swimlane.com Hero AI Native Actionread 2026-10-05