CTIFoundry Boosts Cyber Threat Intelligence Agents with Structured Corpus.

The way cyber threat intelligence (CTI) is consumed is shifting from human analysts to LLM agents that perform multi-step investigations. While agent harnesses have advanced, the underlying CTI corpora are still largely formatted for simple retrieval-augmented generation (RAG), treating threat reports as opaque chunks. This unstructured substrate is identified as a major bottleneck for effective agentic CTI investigation. To overcome this, CTIFoundry, an agent-native corpus scaffold, has been developed. At build time, CTIFoundry extracts and materializes the inherent structure of CTI knowledge bases, creating a deterministic ontology graph. This graph links authoritative sources like CVE, CWE, CAPEC, and ATT&CK through typed, traversable edges, and integrates a span-grounded report layer with alias-resolved entities. It also provides hybrid dense and lexical retrieval surfaces. At query time, this rich structure is exposed to LLM agents through seven typed tools and three procedural skills. Benchmarking on CTIConnect showed that simply swapping to CTIFoundry's action surface improved agent F1 scores by +0.19 to +0.28 across various models. A smaller model using CTIFoundry even outperformed a flagship model on the flat substrate, and the scaffolded agent was more accurate with roughly half the tool calls. This demonstrates that typed structure and procedural skills are key to enhancing agent performance in CTI.