Collective Defense Engine: when cyber threat intelligence meets agentic AI

TLTR

• An accelerating threat landscape: AI is industrializing cyberattacks, while supply-chain risks and technological dependencies are heightening cybersecurity concerns; 
• Proactive, collective defense: Orange Cyberdefense combines its threat intelligence database, human expertise and agentic AI to detect, analyze and share alerts faster; 
• A network effect that benefits customers: the “Collective Defense Engine” pools detection and response capabilities, so that threats identified at one customer can help protect the entire community, while safeguarding each customer’s data privacy.

From reactive and isolated to proactive and collaborative cybersecurity

Cybersecurity for organisations has become a systemic issue: the industrialisation of attacks amplified by AI, supply chain exploitation, the risks of technological dependence… The implications for businesses go beyond mere technological considerations. There are economic and reputational consequences as well. Facing this challenge, organisations must be able to rely on proactive and collaborative capabilities for detection, vulnerability exploitation and incident response. Thanks to its unique expertise, its proprietary threat knowledge base and the integration of AI, Orange Cyberdefense is playing an active role in protecting the economic and social fabric, by providing collective immunity to businesses and organisations of all sizes.

The rise of AI in cybersecurity: gearing up?

The emergence of AI has revolutionised the cybersecurity landscape: attacks are now carried out on a large scale and at an ever-increasing pace. With artificial intelligence, attacks are becoming increasingly sophisticated and industrialised. Their growing level of automation is lowering the level of expertise required to carry out large-scale cyberattacks. On the defensive side, it is now essential to be able to match the speed of the machine by utilising AI’s detection and automation capabilities. Having integrated Qevlar AI into its Security Operations Centres (SOCs) in France and internationally, Orange Cyberdefense is taking a major step forward with the integration of an agent-based layer into its operational model and its proprietary, autonomous threat knowledge base.

The gradual integration of state-of-the-art models into Orange Cyberdefense’s solutions, alongside the recent announcement of its partnership with Mistral AI, enables customers to benefit from the best models on the market within a well-defined governance framework, providing a defensive advantage against attackers who exploit unchecked open-source models

"Collective Defense Engine": the cutting edge in large-scale cybersecurity

This new paradigm requires a proactive… and collective response. By integrating a layer of agentic AI at the heart of its operational model and its CTI, the era of case-by-case protection is over, and businesses now benefit from a cross-functional and truly community-based shield.

With a unique and autonomous threat knowledge base, continuously updated for the past 25 years, Orange Cyberdefense has a major resource at its disposal to protect businesses and citizens. This threat intelligence - CTI, standing for "Cybersecurity Threat Intel" - is continuously fed by various sources:

• A unique access to telemetry data, as well as data from 160 Orange Cyberdefense partners and vendors;
• Research and analysis from Europe’s leading private CERT, authorised since May 2026 to publish new vulnerabilities. It brings together a CSIRT and the WorldWatch teams, which publishes 2,000 vulnerability reports a year;
• Agentic pentesting - enhanced penetration testing - completes the audit phase, enabling Orange Cyberdefense to continuously detect vulnerabilities and configuration issues across our clients’ environments;
• Six million digital assets monitored by our managed SOC and VOC services, whose operations and data sharing are now fully augmented by agentic AI⁽¹⁾;
• Alerts generated by our "Entry+" platform, which oversees 20 million digital assets;
• 600,000 phishing alerts handled by the Orange Cybersecure team.

At the heart of all Orange Cyberdefense solutions, this AI-enhanced CTI facilitates the identification and classification of threats, which are then shared across the entire customer community, thereby drastically improving the response to alerts.

By drawing on a network of agents – who never sleep and face no language barriers – we are creating a seamless communication interface that enables the systematic processing of alerts and allows our client community to benefit from them almost instantly, explains Rodrigue Le Bayon, Deputy to the EVP of the Countries With Business unit at Orange Cyberdefense.  

In practical terms, an alert identified at a company – regardless of its size or geographical location – will be communicated to all staff at the speed of the system. The result? Critical information is thus shared almost instantly with the entire community of companies protected by Orange Cyberdefense, enabling them to safeguard themselves before they are even affected. All whilst respecting the confidentiality of each company’s data.

In other words, our capacity to process alerts and respond to incidents – which previously relied on different teams attached to different companies across different geographical areas – is now pooled. Whilst speed is a critical factor today, we are planning to offer virtual patching and capabilities for isolating, containing and micro-containing the affected resources, to give teams the time to apply patches calmly over a longer period, explains Benjamin Serre.

Towards effective and collective immunity

The integration of agent-based AI into Orange Cyberdefense’s CTI will provide at least three operational benefits:

1. Reduced alert processing times;
2. Management of large volumes of data;
3. Even more cross-functional and effective correlation capabilities.

The positive aspect of this approach, which combines AI, proprietary data and human expertise, translates into shared protection for businesses, benefiting the entire Orange Cyberdefense customer community as it grows.

The "Collective Defence Engine" does not replace software vendors. We work alongside them to complement their defence solutions. As our ecosystem and customer community grow, so does the value of our shared intelligence, helping deliver stronger, more effective protection through our proprietary collective netfork effect” concludes Rodrigue Le Bayon.

This new milestone in AI cybersecurity reaffirms Orange Cyberdefense’s credo: to build a safer digital society. 

Footnotes