Cyware vs Tines (2026)

More than 400 integrations connect the platform, and agents take direct action through existing security tools over MCP server connections. Cyware Orchestrate carries out app actions across the connected stack, and Cyware counts more than 10 million mitigation actions.

Sourcecyware.comread 2026-09-28

HTTP Request actions call any tool with an API using tenant credentials. Unlimited connectors come on every edition, and library stories let agents act in CrowdStrike, Jira, Slack, Azure Sentinel, AWS and others with the customer's own credentials. Further library stories work with Code42, Reality Defender and Google Threat Intelligence, Send Email actions deliver mail from a story, and Workbench and the AI Agent action can call remote MCP servers as tools. The free edition already includes unlimited users, spaces and connectors.

SourceTines, tines.com/library, /pricing and tines.com/docs AI Agent action; tines.com/stories/docs/actions/typesread 2026-10-05

Cyware Orchestrate runs node based playbooks the customer builds, with an LLM assisted Playbook Builder Agent and a Custom Code Generator. Orchestration playbooks run with bounded autonomy and guardrails the customer defines.

Sourcetechdocs.cyware.com/conextgen/en/playbooks.htmlread 2026-09-28

Teams build stories from webhook, email, HTTP request, condition, event transform, Send to Story and AI Agent actions, chaining stories and agents into their own flows. The AI Agent action runs in task mode, as a one shot prompt or an autonomous agent that calls tools toward an objective, or in chat mode on a Tines page where users talk to it until a set goal is met. Its tools can be public or custom templates, other stories attached through Send to Story with their own timeouts, custom tools built in the same story and remote MCP servers, and Condition actions branch a story's path.

SourceTines, tines.com/docs AI Agent action and action types; tines.com/stories/docs/actions/typesread 2026-10-05

Intelligence is ingested, enriched, scored and acted on automatically as it arrives, and Orchestrate playbooks fire on their own when alerts and intelligence come in. The DRP Triage Agent prioritizes incoming alerts.

Sourcecyware.comread 2026-09-28

Webhook actions start stories on inbound events from external services, and Receive Email actions start them on inbound mail, without a prompt. An AI Agent in chat mode sits on a Tines page where people start conversations, and Workbench takes Cases and events sent to it. Outside AI clients can also run stories through the Tines MCP server.

SourceTines, tines.com/stories/docs/actions/types, Workbench and AI Agent action docsread 2026-10-05

Cyware Intel Exchange ingests, enriches, scores and relates threat intelligence into a maintained repository that the agents query through CQL search, threat data objects and enrichment metadata. It is a persistent store of the customer's own intelligence.

Sourcecyware.com/blog/talk-to-your-threat-intelligence-platform-introducing-the-cyware-mcp-serverread 2026-09-28

Workbench reaches the customer's proprietary data in real time by running stories as tools, and Records and Resources hold structured data for stories. Tines offers no published knowledge base or search index for the AI to draw on. Users can send Cases and events into Workbench for context and attach images or documents of up to 4.5 MB, three to a message, and skills hold reusable task instructions written in place or imported as markdown files.

SourceTines, tines.com/stories/docs/workbenchread 2026-10-05

Agents connect to the deployment with no local data storage. Outside the threat intelligence repository, agents have no memory with a set scope and lifetime.

Sourcecyware.com/blog/cyware-ai-agent-ecosystem-deep-dive-operational-impactread 2026-09-28

Workbench keeps chat history that users can search, rename and delete, and Records persist structured data across story runs. Tines does not describe the AI Agent action remembering anything from one run to the next. How long chat history is kept depends on the plan, users can set custom instructions for their conversations, and an agent in chat mode keeps the conversation going until its goal is met.

SourceTines, tines.com/stories/docs/workbench and tines.com/docs AI Agent actionread 2026-10-05

Customers define approval workflows, autonomy levels and governance policies, so agents only perform authorized actions, and every action is authorized and logged. The customer places the approval step before agent actions. How these workflows work is not published.

Sourcecyware.com/quarterback-airead 2026-09-28

In Workbench, templates that may change the environment "will prompt the user to confirm before running", and any story can be set to "Require confirmation to run". The story then waits for a person to approve it before anything runs. The library includes a story for requesting and approving Slack posts to a restricted channel. Admins allocate AI credits to teams, and token use thresholds can send a notification or switch the AI Agent action off.

SourceTines, tines.com/stories/docs/workbench, tines.com/library and tines.com/docs AI Agent actionread 2026-10-05

A SOC 2 Type 2 report and ISO 27001:2022 certification from Coalfire are in place, and the FedRAMP Marketplace lists Cyware Cyber Fusion Center as Legacy FedRAMP Ready at Moderate. Agents act only on authorized actions, but there is no published console SSO, role model or permission reference.

Sourcecyware.com/complianceread 2026-09-28

Tines holds SOC 2 Type II, audited annually, with reports in the trust center. SSO/SAML comes on all plans, along with teams that separate users, credentials, resources and stories, user administration, IP access control and action egress control. Workbench gives each user only the credentials and stories their permissions allow, and AI providers can be scoped to specific teams, with the team that owns a provider's credential always keeping access.

SourceTines, tines.com/security, tines.com/stories/docs/workbench and AI admin docsread 2026-10-05

Playbook run logs show every node's inputs and outputs, execution status, run time and errors with debug information. Agent actions are fully audit logged with tenant isolation, giving a record of each step the automation takes. MTTD and MTTR are reported across the estate.

Sourcetechdocs.cyware.com/conextgen/en/run-logs.htmlread 2026-09-28

Every action in a story emits events that record each step of a run. All actions performed in Workbench are available in audit logs, and an audit log is captured whenever a user changes data in the tenant. Every agent run appears in those events and logs. Token use is tracked against each team's AI credit allowance, with notifications as a team nears its limit.

SourceTines, tines.com/stories/docs/workbench and AI admin docsread 2026-10-05

Deployment can be cloud, on premises or air gapped, with staging environments too, and the deployment model feeds into the quote.

Sourcecyware.com/pricingread 2026-09-28

Tines is both a cloud service that Tines hosts and a product that customers can host themselves. Self hosted Tines runs in the customer's environment on AWS ECS and EKS, Azure, Google Kubernetes Engine, Red Hat OpenShift, VMware and Docker Compose, and paid editions list flexible deployment options. The hosted service also has an EU stack, where web search is limited by egress restrictions. The free edition runs three live workflows, and paid editions remove the limit.

SourceTines, tines.com/stories/docs/self-hosted, /pricing and tines.com/stories/docs/workbenchread 2026-10-05

The Agent Hub offers named prebuilt agents with stated jobs, including Threat Intel Research, Vulnerability Exposure Analysis, DRP Triage, Threat Briefing, Priority Intelligence Requirement, Vulnerability Triage, Security Advisory, Detection Engineering and Attack Flow Intelligence, plus a Playbook Store.

Sourcecyware.com/airead 2026-09-28

Customers import prebuilt stories from a public library, including AI agent templates such as triaging Azure Sentinel incidents with an AI Agent and looking up IOCs via Slack using an agent.

The library spans security, IT operations, infrastructure, engineering, product, asset and app management, employee lifecycle, incidents and alerts, communication and ticket synchronization, with stories such as analyzing SMS messages for scams with OCR and AI, containing or releasing CrowdStrike hosts from Jira and detecting deepfakes with Reality Defender. Workbench adds prebuilt templates that need only credentials, and team admins can package tools, credentials and instructions as Presets.

SourceTines, tines.com/library and tines.com/stories/docs/workbenchread 2026-10-05

The models behind Cyware's agents are not named, and customers get no choice of provider. LLMs run in playbooks, and MCP support lets outside assistants reach Cyware, but neither lets the customer choose a model.

Sourcecyware.com/airead 2026-09-28

AI features run on Anthropic's Claude through AWS Bedrock by default, and "it is possible to bring your own AI provider to power all of our AI features", scoped to teams by credential. Bring your own model is listed on paid editions. Admins can set separate smart and fast models, providers brought in can be OpenAI, Anthropic, Azure OpenAI, Helicone, OpenRouter, xAI or Ollama, and each AI Agent action picks its own model from those available. The free edition comes with a one time $50 AI allowance.

SourceTines, tines.com/stories/docs/admin/ai, /pricing and tines.com/docs AI Agent action; tines.com/stories/docs/adminread 2026-10-05

The open source Cyware MCP Server (github.com/cyware-labs/cyware-mcpserver) comes with install steps, a choice of transport (stdio or SSE), authentication with Cyware application credentials and a full tool list for Intel Exchange and Orchestrate. Its tools include creating intel, tags and bulk actions and running playbooks and app actions. A playbook API sits at orchestrateapi.cyware.com.

Sourcegithub.com/cyware-labs/cyware-mcpserverread 2026-09-28

Developers get the Tines API, Terraform support and a Tines MCP server at https://your-tenant.tines.com/mcp with OAuth, whose tools read, create, update, validate and run stories and actions from outside AI clients.

Sourcetines.com/stories/docs/mcp-serverread 2026-09-28

Run logs give node level debug information with error summaries and remediation steps, and an AI Playbook Runlog Debugger analyzes failed runs. There is no harness, scored test case or quality gate for the agents.

Sourcetechdocs.cyware.com/conextgen/en/run-logs.htmlread 2026-09-28

Story contents can be validated before they run, and a validation tool is exposed through the MCP server; both check the story's configuration. Tines publishes no way to run an AI Agent action against test cases and score its answers. An output schema can make the AI Agent action return JSON that is validated against it, and each action sets its own temperature from 0 to 1.

SourceTines, tines.com/stories/docs/mcp-server and tines.com/docs AI Agent actionread 2026-10-05

The Agent Hub is also delivered as a Chrome and Edge extension. That is where the product runs, and no agent operates the browser. The agents connect back to the Cyware deployment by API.

Sourcecyware.com/blog/cyware-ai-agent-ecosystem-deep-dive-operational-impactread 2026-09-28

Browser or screen use by Tines agents is not described. Tines acts through API actions. The AI Agent action's built in tools are a planning scratchpad, code analysis and web search, which fetches page content for the agent to read.

SourceTines, tines.com/stories/docs/actions/types and tines.com/docs AI Agent actionread 2026-10-05