CYBERSECURITY
Generally availableStructured threat evidence your SOC can route without a human reading first.
Phishing, credential abuse, and attack-surface language across 200 labels and 15 languages - every result pinned to a configuration ID you can replay during an investigation.
200 labels · 15 languages · p95 target <500ms · No generative model is used to produce classifications
Re-run with the same pinned version → identical result
What this analyzer does and doesn't do
- Detect phishing, credential-abuse, and attack-pattern language in text
- Extract CVE, advisory, and exploit-reference signals from unstructured reports
- Cover 15 languages with per-language evaluation
- ✕Scan networks, endpoints, or infrastructure
- ✕Confirm whether a compromise actually occurred
- ✕Access your logs, telemetry, or SIEM data
- ✕Attribute attacks to specific actors
Sentiqra returns structured signals. Your policy, reviewers, and models make the decision. See the full boundary statement →
WHAT YOU'LL DETECT
Specific threat behaviors - not a generic "malicious" score.
Phishing & Social Engineering
credential_lure
“Verify your account within 24 hours” → very high
Credential & Identity Abuse
credential_theft
“This is IT support - send your password” → very high
Ransomware & Destructive Activity
ransom_note
Detected - example withheld
Command & Control
beaconing
Detected - example withheld
Cloud & SaaS Abuse
oauth_consent_abuse
Detected - example withheld
85.3% – 96.6% Production Top-3 Hit Rate across 15 languages.
Benchmarks vary by language - the range above is the honest spread, not the best case. Top-3 Hit Rate means the expected label appears among the 3 highest-confidence signals returned; it measures ranking quality, not whether a thresholded accept/reject decision was right.
WHERE IT GETS USED
Three jobs this analyzer does well.
Reported-phishing triage
An MSSP handling tens of thousands of reported messages per day routes each through Cybersecurity before an analyst opens it. Credential-lure and spear-phishing labels sort the queue automatically; reproducible receipts make every verdict defensible when a client disputes a false negative.
Fit signals: high report volume · multilingual lures · SLA-bound triage
Threat-intel normalization
A security vendor turns unstructured advisories, vendor bulletins, and forum chatter into structured events. CVE references, affected products, and attack vectors land as labeled signals instead of free text - ready for correlation pipelines.
Fit signals: unstructured feeds · entity extraction · pipeline ingestion
Alert enrichment with attack context
A SOC enriches incoming alerts with the technique language they contain - lateral movement, exfiltration, persistence - so analysts see the ATT&CK-adjacent context before they pivot. Because the analysis is deterministic, the same alert text always enriches the same way.
Fit signals: alert fatigue · enrichment pipelines · ATT&CK workflows
Send a reported message. Get routed signals + a receipt.
POST /v1/analyze
Authorization: Bearer sq_live_your_api_key_here
{
"text": "Urgent: your mailbox quota is full. Verify your password now to avoid suspension.",
"language": "en",
"analyzers": ["cybersecurity"]
}{
"language": "en",
"signals": [
{ "analyzer": "cybersecurity", "code": "phishing_delivery", "label": "Phishing Delivery", "score": 0.9, "confidence": "very_high", "level": "category" },
{ "analyzer": "cybersecurity", "code": "credential_lure", "label": "Credential Lure", "score": 0.9, "confidence": "very_high", "level": "label", "parent": "phishing_delivery" },
{ "analyzer": "cybersecurity", "code": "urgency_lure", "label": "Urgency Lure", "score": 0.9, "confidence": "very_high", "level": "label", "parent": "phishing_delivery" }
],
"meta": { "analyzers": [{ "name": "cybersecurity", "status": "completed", "signal_count": 3, "billed": true }], "partial": false },
"usage": { "analyzer_runs": 1, "billed": true },
"verification": {
"configuration": "sqcfg_6X29ABXM",
"fingerprint": "fp_8a72...19f",
"input_commitment": "ic_31bd...a42",
"signature": "sig_ed25519_4c1f...e2a"
}
}READING THE OUTPUT
What a Cybersecurity result tells you - and what it doesn't.
Intended task
Turn security-relevant text - reported phishing, incident notes, threat-intel prose - into structured threat indicators your SOC queue can route on.
Input requirements
text- the only field analyzed; up to 4,096 Unicode code points. Over the limit is rejected withinput_too_long, never truncated.language- must be a language this analyzer supports. Unsupported codes are rejected with400 unsupported_language, never analyzed as a different language.analyzers- include"cybersecurity"; up to 2 analyzers per request, one billed run each.- No context beyond
text- no user IDs, history, profiles, or attachments are read or inferred. - Analyzes message/report text only - headers, rendered URLs, attachments, and telemetry are out of scope.
Ordinary positive
“Your mailbox storage is full. Verify your password within 24 hours at the link below or your account will be suspended.”
Safe inference: The text matches documented phishing patterns. You can route it to a credential-threat lane and attach the receipt to the ticket.
Confusing negative · Quotation
“The lure read "verify your password within 24 hours" - the SOC confirmed the campaign on Tuesday.”
What happens: Phishing indicators can still fire on the quoted lure. The signal describes the language in the text - it is not evidence that an attack actually occurred, and not a verdict on the analyst's report.
Why it's tricky: The analyzer cannot distinguish a lure from someone quoting a lure. Signals on incident write-ups and forwarded phish are expected - triage by where the text came from, not just what it says.
What you can safely infer
- Which documented threat indicators the text matched, and at what signal-match strength.
- That the same input on the same pinned configuration replays identically for your incident record.
What you must not infer
- ✕That a flagged sender, domain, or account is actually malicious.
- ✕That a described incident actually happened - the signal describes the text, it does not verify events.
- ✕That unflagged text is benign - a missing signal means "not detected," never "safe."
- ✕Anything about your network state - the analyzer sees text, not logs or endpoints.
Boundary: Security-language signals are not proof of compromise. A phishing or credential-abuse signal means the submitted text matches documented attack language - it does not confirm that an attack occurred, that a credential leaked, or that a sender is malicious.
Cybersecurity is on every plan. Even Free.
Free
5,000 runs/mo
Build
$149/mo · 50,000 runs/mo
Growth
$349/mo · 150,000 runs/mo
Production
$799/mo · 500,000 runs/mo
Scale
$2,999/mo · 2,500,000 runs/mo
Enterprise
By agreement · SOC 2 Type II in progress
Deterministic by construction, provable by receipt.
A signed verification receipt - configuration ID (sqcfg_...), result fingerprint (fp2_...), input commitment (ic3_...), and Ed25519 signature (sig_ed25519_...) - ships with every successful analysis result. Pin it to the stored decision and a later replay under the same supported configuration and output profile yields the identical canonical result - the difference between "the model said so" and evidence.
Where it fits in your stack
Often paired with: Disinformation for coordinated campaigns, Trust & Safety for phishing inside user messages, Crisis Intelligence for conflict-adjacent threat reporting.
Used in: Security Operations and Phishing & Account Protection
Run your reported-phishing queue through it.
5,000 analyzer runs/month · No card required
Analyzer FAQ
New to Sentiqra? It's a deterministic text-analysis API - you send text, you get labeled, confidence-scored signals plus a replayable receipt. Cybersecurity is the cybersecurity threat detection analyzer.
What does Cybersecurity detect?
Detect phishing, credential abuse, malware, persistence, command-and-control, and security incident signals.
Which languages does it cover?
15 supported languages, each with a published per-language benchmark. Coverage is per-analyzer, not platform-wide - check the language list on this page before assuming parity with other analyzers.
How do I call it?
POST /v1/analyze with "analyzers": ["cybersecurity"]. Same endpoint, auth, and response shape as every other analyzer - you can pair it with one more analyzer in the same request.
What does a call cost?
One analyzer run per call, billed against your plan's included runs (overage per plan). All GA analyzers are on every plan, including Free - see pricing.
How do I evaluate it on my data?
Label a few hundred of your own examples, run them through the free tier, and compare our signals to your labels. The evaluation playbook walks through building that test set - it's the same method we use internally.