Intelligence Center 3.9: More AI provider choice, MITRE ATT&CK v19.1 support, and more

Intelligence Center 3.9 introduces new flexibility for working with AI by expanding model connectivity and updating threat intelligence mapping. The platform now supports connecting to Azure, Anthropic's Claude, and Mistral, alongside existing support for OpenAI, Perplexity, Ollama, and Amazon Bedrock. This allows users to select the optimal LLM based on infrastructure, compliance, or performance goals for tasks like search and summarization. Intelligence Center connects to LLMs hosted by the user, in the cloud, or via third-party SaaS providers, promoting flexibility to avoid vendor lock-in. Furthermore, the platform now supports MITRE ATT&CK v19.1, updating threat mappings. Specific changes include splitting the Enterprise Defense Evasion tactic into Stealth and Defense Impairment, introducing new sub-techniques for ICS ATT&CK, and introducing Detection Strategies in Mobile ATT&CK. Quality-of-life improvements include faster report attachment spotting, visibility into vendor pricing, and a standardized date/time setting for new users.

The core innovation of this update centers on shifting the platform from a monolithic system to an adaptable orchestration layer for diverse AI models. The expansion of LLM support addresses a clear tension in the market: the need for specialized performance versus the constraints imposed by varied enterprise infrastructure and regulatory landscapes. By allowing seamless integration with various providers, the release actively attempts to neutralize vendor lock-in, positioning the platform as an agnostic hub rather than a dependent endpoint for any single model architecture. This suggests a pattern of systemic resistance to centralized AI control, where users seek granular sovereignty over their operational stack. The alignment with MITRE ATT&CK v19.1 reveals a concern that merely processing data is insufficient; the focus shifts toward actionable, granular operational knowledge. Splitting tactics and adding sub-techniques in frameworks like ATT&CK reflects a growing need for precision in adversary modeling, moving beyond high-level categorization to detailed operational observation across complex environments like ICS. The quality-of-life improvements indicate an understanding that adoption requires friction reduction; the complexity of integrating multiple systems must be managed through intuitive design. The underlying implication is that true resilience in an AI-driven threat environment is achieved not just through access to powerful models, but through systemic architectural freedom and finely tuned operational context. What limits the potential for genuine sovereignty if integration remains a feature layered atop existing constraints? How does organizational inertia resist adopting this level of model heterogeneity?