Cantina introduces The Brain to give security agents institutional memory

The Brain functions as a central nervous system for Cantina’s autonomous workforce, mapping relationships between identities, AWS resources, GitHub repositories, and managed devices. By moving beyond simple alert triage, the system enables agents to understand the significance of an issue within the unique topology of a specific organization. This shift replaces manual discovery tasks with a structured record of previous findings, operational constraints, and benign patterns identified by human teams.

In early observational tests using low-severity Okta alerts, the integration demonstrated measurable efficiency gains. Cantina reported that workspaces equipped with The Brain resolved alerts in 170.8 seconds on average, compared to 220.4 seconds in standard environments. This represents a 22.5% reduction in time-to-closure and a 36.1% decrease in the number of tool calls required per investigation. According to CEO Hari Mulackal, the goal is to mirror the tacit knowledge experienced engineers accumulate over years, allowing software agents to access the same institutional context when evaluating suspicious activity.

The platform currently uses deterministic matching to reconcile entities, while allowing both human operators and agents to refine records over time. Data remains siloed within individual workspaces, ensuring that sensitive organizational knowledge stays contained. Following a $16.5 million total funding milestone, Cantina positions this memory layer as a foundational component for automated security, allowing agents like their Apex model to map attack paths and verify remediations with improved precision.