Team Cymru launches Pure Signal Command for threat response

Team Cymru has launched Pure Signal Command, a product that brings the company's internet infrastructure intelligence into a single operating environment.

The launch adds a new interface to Team Cymru's existing telemetry, investigative tools, and threat intelligence feeds, with access for analysts, security teams, applications, and AI agents. It is designed to let users move from discovery to response without switching between separate tools.

Pure Signal Command draws on Team Cymru's network telemetry and intelligence sources, including NetFlow data, BGP and routing data, partner telemetry, WHOIS records, and malware intelligence. Users can query the system in natural language and review both current and historical information, with provenance attached to the data.

According to Team Cymru, the platform supports the full threat intelligence workflow, including discovery, enrichment, investigation, attribution, operational use, and response. It also includes machine-native access through the company's Pure Signal Model Context Protocol server, with an option for human review.

The system is built on more than 400 billion daily internet connections, over 1,000 data-sharing partnerships across more than 140 countries, and more than 2,000 behavioural tags curated by its S2 Research Team. Team Cymru said this foundation helps security teams track adversary infrastructure as it appears and shifts across the internet.

Unified access

Team Cymru is seeking to address a common problem for security operations teams, which often rely on multiple products for infrastructure data, investigation, and response. Pure Signal Command gives customers and their software agents access to the same connected environment, with the aim of preserving context during an investigation.

That includes access to the broader Pure Signal suite and the Total Insights Feed. According to Team Cymru, those components cover investigative enrichment, campaign mapping, infrastructure attribution, attack surface monitoring, threat hunting, third-party exposure analysis, and structured intelligence for SIEM and SOAR systems.

The platform also integrates with Splunk, Microsoft Sentinel, Cortex XSOAR, and Cyware. Team Cymru said this should allow security operations centre and incident response teams to receive additional context with alerts and feed the intelligence into existing workflows.

Product strategy

The launch marks a step in Team Cymru's effort to package its long-running internet telemetry business into a more unified operational product. The company has built its reputation on internet-scale visibility and services used by computer security incident response teams around the world.

Command is designed not only for human analysts but also for agent-driven environments, reflecting a wider shift in cyber security toward automation and AI-assisted investigation. Users can pivot across IP, ASN, domain, and certificate data without losing the thread of an inquiry, according to Team Cymru.

Joe Sander, Chief Executive Officer at Team Cymru, described the launch as part of the company's broader mission in threat disruption. "Team Cymru's mission is to save and improve human lives by partnering with security teams around the world to track and disrupt bad actors and malevolent infrastructures, and we have led the way for over 20 years," Sander said.

He added: "Pure Signal Command is the next meaningful step in that mission as we enable defenders to achieve significant outcomes: disrupting threats, reducing risks, and accelerating incident response from hours and days to minutes."

Tim Jones, Chief Technology Officer at Team Cymru, set out the operational argument for the new system. "Pure Signal Command is transforming how we identify and stop threats," Jones said.

"Instead of having to combine a patchwork of tools or switch between workflows, users can access all of Team Cymru's global telemetry, including current and historical data, so they get full and continuous context while evaluating the next steps. And because Command provides validated, current intelligence in a machine-native ecosystem, AI agents can ingest vast amounts of information. This will help defenders turn external visibility into action faster, giving them back the time to investigate before compromise, block before disruption, and act before damage is done."

Market context

The cyber security market has seen growing interest in platforms that combine external threat intelligence, attack surface monitoring, and automated investigation. Vendors are also racing to adapt their products for AI agents while trying to keep human oversight in place for higher-risk decisions.

For Team Cymru, the launch brings together data assets and research previously consumed through separate products and feeds. According to the company, chief information security officers can use the platform for observable risk data and board reporting, while threat hunters and incident response teams can use it for infrastructure tracking and alert triage.

Will Baxter, Head of Product Management at Team Cymru, said the company sees the product as a way to help defenders respond more quickly. "Team Cymru is trusted by those who defend the internet," Baxter said.

"We built Pure Signal Command, with its integrated capabilities and proactive insights, to give defenders the tools to rapidly fight back against threat actors. Command's integrated workflows, agentic AI capabilities, and insights help organizations discover threats before impact and move to implement protective measures at scale."