Researchers have developed CTIFoundry, a framework for creating a structured corpus of cyber threat intelligence data. This corpus is designed to be consumed by large language models (LLMs) and other agents, allowing them to perform multi-step investigations more efficiently. The authors argue that the current way of packaging threat reports and vulnerability databases as opaque chunks behind an embedding index is a bottleneck in agentic CTI investigation. They present CTIFoundry as a solution, which materializes the latent structure of a CTI corpus at build time and exposes it through typed tools and procedural skills at query time. The authors demonstrate the effectiveness of CTIFoundry by showing that swapping only the action surface lifts the identically-harnessed agent's performance on the public CTIConnect benchmark. --- Why it matters: This matters to engineers working with large language models and cyber threat intelligence because it provides a more efficient way for these agents to consume and process data, potentially leading to improved investigation outcomes. The structured corpus and procedural skills in CTIFoundry can also be applied to other domains where LLMs are used. Source: https://arxiv.org/abs/2608.18613