Cantina Unveils Shared Memory Layer for Autonomous Security Agents

NEW YORK – Cantina today unveiled The Brain, a shared context and memory layer designed to equip its autonomous security agents with persistent knowledge of a customer's environment. The system connects people and systems by integrating operational context and prior investigations, enabling agents to better understand the significance of alerts within a specific organization and carry relevant insights from one investigation to the next.

Security investigations typically require piecing together information scattered across various technology platforms. An alert might point to an AWS role, GitHub repository, or Okta user, but crucial context can reside in SIEM systems, cloud platforms, endpoint consoles, ticketing systems, or past investigations. Cantina's The Brain aims to consolidate this data, allowing agents to initiate investigations with a foundational understanding of the alert's surrounding environment.

The solution combines structured data with agentic memory. Structured data links entities through stable identifiers, such as repository or service identifiers. Agentic memory retains context that doesn't fit neatly into relationships, such as reasons why a particular pattern was deemed benign or what a previous investigation revealed about a suspicious IP address.

"Autonomous security workers need to know far more than what appears in an alert," said Hari Mulackal, CEO and co-founder of Cantina. "The Brain gives Cantina's workers persistent access to that organizational knowledge, so they can use it every time they investigate and resolve an issue."

In comparative tests, The Brain reduced alert triage time by 22.5% and decreased tool calls by 36.1% compared to environments without the layer. Cantina, which raised $8 million in funding in July, is building an autonomous security workforce focused on identifying and remediating threats before they can be exploited.