01SOC
SOC Teams
Prioritize CTI, generate hunts, review evidence, move findings into triage, and report what changed.
Best for
- Reducing feed noise
- Review-first hunt generation
- Case handoff and analyst evidence
- Operational reporting
Use Cases
Threat Foundry adapts to the way defenders actually work.
Use Threat Foundry as a SOC workbench, MSP service engine, CTI operations layer, KEV Hunter scanning and vulnerability hunting workflow, detection engineering queue, incident response feedback loop, or executive reporting surface.
Defenders
Use cases by team and operating model.
02MSP
MSP and MSSP Providers
Package repeatable CTI-led hunting, KEV scanning, and detection review across customer environments.
Best for
- Customer-ready hunt packages
- Monthly or biweekly reporting
- KEV-driven outreach
- External exposure checks
- Service tier design
03Midmarket
Midsize Businesses
Build a practical detection program without enterprise-scale staffing or tooling complexity.
Best for
- Focused CTI triage
- Priority hunts
- Detection backlog reduction
- Executive summaries
04Enterprise
Enterprise Detection Engineering
Govern generated hunts, Sigma, YARA, field normalization, evidence, ownership, and lifecycle review.
Best for
- Detection-as-code discipline
- Telemetry assumptions
- Coverage and maturity metrics
- Community content review
05CTI
CTI Teams
Turn intelligence requirements, reports, KEVs, and adversary context into prioritized action.
Best for
- Quality gates
- ATT&CK mapping
- Hunt and detection routing
- Source feedback loops
06Vuln
Vulnerability Analysts
Run scoped external KEV scans, separate internet-facing known-exploited findings from generic vulnerability volume, track exposed services, review evidence, and drive remediation status.
Best for
- External KEV scanning
- Public asset drilldowns
- Open port and service discovery
- Due and overdue remediation
- Retest and CSV export
07IR
Incident Response Teams
Convert incident evidence into reusable hunts, Sigma/YARA candidates, lessons learned, and reports.
Best for
- DFIR-to-detection feedback
- YARA from malware traits
- Post-incident validation
- Control improvement tracking
Fit Check
Map Threat Foundry to your operating model.
Bring your current CTI, hunt, KEV scanning, vulnerability management, detection, or managed-service workflow and we will show where the platform fits.