The cybersecurity industry has a 4.8 million person workforce gap. Protos Labs thinks AI agents — not more hiring — are the way to close it.
At RSAC 2026, Protos Labs launched a freemium edition of Protos AI — a platform that deploys specialized AI agents to execute structured cyber threat intelligence (CTI) investigations. From planning to evidence collection to citation-backed reporting, the agents work like a coordinated analyst team, with human analysts directing strategy and validating outputs.
The freemium tier is available immediately, with no data migration or infrastructure overhaul required.
How It Works
Protos AI doesn’t operate as a chatbot that answers security questions. It deploys coordinated agents with specialized roles, each aligned to a phase of the CTI lifecycle:
- Planning — agents scope the investigation, define objectives, identify sources
- Evidence Collection — agents query live OSINT sources, correlate threat entities
- Correlation — agents link IP addresses, domains, malware families, threat actors across data
- Analysis — agents synthesize findings into structured assessments
- Reporting — agents produce citation-backed investigative reports
Human analysts stay in control: approving investigation plans, guiding direction, and validating outputs before dissemination. The agents handle the structured execution that previously consumed most analyst time.
Intelligence That Compounds
The most interesting architectural choice is what Protos calls “organizational intelligence memory.”
Each investigation contributes to a persistent intelligence record owned by the organization. The system automatically links entities across investigations — when an indicator resurfaces months later, historical context appears automatically.
This solves two persistent problems:
Knowledge loss from turnover — when an analyst leaves, their institutional knowledge usually goes with them. Protos AI preserves it structurally.
Repetitive analysis — security teams often investigate the same threats repeatedly because previous findings aren’t accessible. Compounding memory eliminates this waste.
CEO Joel Lee framed it clearly: “The next phase of cybersecurity will be defined not by the number of analysts you hire, but by how effectively your intelligence compounds.”
Model-Agnostic, No Lock-In
Protos AI supports Azure OpenAI, Anthropic Claude, and Google Gemini — organizations choose based on their security, compliance, and cost requirements. Deployment options include public cloud, isolated VPCs, on-premises, and air-gapped environments.
This matters because threat intelligence often involves sensitive data. The ability to run the platform on-premises or in an isolated VPC, with the AI model of your choice, removes a major adoption barrier.
Freemium vs. Enterprise
The freemium edition provides immediate access to:
- Autonomous, agent-run investigations
- Curated OSINT intelligence integrations
- Structured multi-step investigation workflows
- Citation-backed reporting
The enterprise edition adds:
- Commercial threat feed integrations
- SIEM and EDR telemetry correlation
- Asset inventory integration
- Proprietary system connectors
What OpenClaw Users Should Know
Protos AI’s architecture mirrors patterns familiar to the OpenClaw community:
- Multi-agent coordination with specialized roles (like OpenClaw’s agent team model)
- Human-in-the-loop approval for investigation plans (like OpenClaw’s ask-first principle)
- Persistent memory that compounds over time (like MEMORY.md, but for threat intelligence)
- Model-agnostic design without vendor lock-in
For OpenClaw users running security monitoring workflows — checking logs, scanning for anomalies, investigating alerts — Protos AI represents a professional-grade CTI workflow that could complement agent-based monitoring.
The freemium model lowers the barrier to experimentation. If you’re curious about structured agentic CTI, you can try it without commitment.
The Takeaway
Protos Labs is betting that the future of threat intelligence is compounding, agent-driven, and accessible to teams that can’t afford large analyst headcounts. The freemium model, model-agnostic architecture, and organizational memory are designed to make AI-driven CTI a default capability rather than an enterprise luxury.
In a week where most RSAC vendors are charging premium prices for AI security tools, shipping a freemium agentic CTI platform is a deliberate counter-positioning. Protos Labs wants adoption first, monetization second.