SpyCloud, an Austin-based identity threat protection company, released Research Agent on Wednesday, a conversational AI tool that plans and executes cybercrime investigations autonomously. The agent is now available inside SpyCloud’s Cybercrime Investigations console and targets cyberthreat intelligence analysts, SOC teams, fraud investigators, and incident response leads.
How It Works
Research Agent operates across three layers. First, it establishes investigative context by linking related credentials, infected machines, domains, and exposure data from SpyCloud’s repository of more than 1 trillion recaptured identity assets sourced from infostealer malware logs, phishing kits, combolists, and data breaches. Second, it applies reasoning to determine which investigative pivots are worth running and in what order. Third, it delivers findings in analyst-ready formats: narrative summaries, tables, timelines, or prioritized escalation recommendations.
The agent accepts natural-language prompts or mixed batches of indicators (emails, domains, IP addresses, usernames, machine identifiers) and correlates across all of them simultaneously. According to SpyCloud’s press release, the tool returns 8x more identity records, 14x more plaintext passwords, 5x more linked emails, and 2x more malware infections compared to exact-match queries alone.
“There’s a real and valid concern in this industry about AI tools that return confident-sounding answers with nothing behind them,” Damon Fleury, SpyCloud’s Chief Product Officer, said in the company’s announcement. “Every finding is grounded in verified recaptured intelligence, specific records, traceable provenance, reasoning you can audit.”
The Tradecraft Layer
SpyCloud says the investigative logic encoded in Research Agent comes from its in-house cybercrime investigators, including former federal agents and intelligence operatives. The intent is to let junior analysts operate at a senior level by encoding institutional knowledge about which pivots matter for specific threat types and which patterns signal criminal activity.
Phil Fuster, SpyCloud’s VP of Federal Sales, described the problem the tool addresses in a LinkedIn post cited by ExecutiveBiz: “Analysts are connecting fragments, following threads, validating relationships, and trying to move from a single data point to an actionable conclusion as quickly as possible. When AI is paired with the right data and the right investigative expertise, it can help teams move faster without taking analysts out of control.”
Where Research Agent Fits in the Stack
Research Agent builds on two existing SpyCloud capabilities: IDLink, an automated digital identity correlation engine, and AI Insights, which generates exportable identity findings reports. The new agentic layer adds investigation planning and sequencing on top of those tools. SpyCloud also recently expanded its partnership with Okta through integrations that use the same trillion-asset repository and IDLink correlation technology to automate identity threat detection, according to ExecutiveBiz.
Agents in Domain-Specific Expert Work
SpyCloud’s launch adds to a pattern emerging across cybersecurity: AI agents moving from general-purpose chat assistants into operational roles within specific professional workflows. OpenAI’s GPT-5.5-Cyber targets autonomous vulnerability discovery. Palo Alto Networks uses agents for threat intelligence in ClawHub analysis. SpyCloud’s approach is narrower, focused on a single workflow (cybercrime investigation) and grounded in a proprietary data asset rather than general web knowledge. The question for buyers is whether domain-locked agents that reason over verified data outperform broader tools that cover more ground with less depth.