Merlino

Merlino is a next-generation cyber intelligence platform delivered as a Microsoft Excel add-in. It helps analysts and professionals operationalize intelligence: map detections to MITRE ATT&CK, validate coverage with real tests, and turn findings into actions—without adding new infrastructure or forcing a new UI.

Getting Started with Merlino

Merlino is an operating method, not a product

Rethinking Cyber Intelligence for the AI Era

AI-Driven Threat Intelligence, Built Into Excel

Merlino transforms spreadsheets into a structured CTI workflow. Ingest intelligence, extract and normalize TTPs, map to MITRE ATT&CK, and turn analysis into decisions your team can track, share, and audit—without changing tools.

Explore the Intelligence Workflow

Operational Security Reinvented

Prove Detection Coverage With Real Execution

Coverage is not a statement—it’s evidence. Merlino connects ATT&CK techniques to detections and validation tests, so you can measure gaps, prioritize what matters, and continuously improve using repeatable runbooks and adversary emulation.

Validate Your Coverage

Securing IT & OT with Intelligence

One Workbook to Unify ATT&CK, Detections, and Tests

Stop juggling disconnected tools and exports. Merlino consolidates techniques, data sources, detections, and test results into a single portable, offline-capable workbook—making security work faster, clearer, and easier to report.

See the Unified Workflow

Purple Teaming is no longer slow, manual, or fragmented.

Merlino is not “another security tool”. It’s an operating method that turns threat intelligence into repeatable validation: profile threats, map TTPs, run targeted tests (with or without Caldera), and measure what your detections actually cover. You keep your existing stack — Merlino makes it actionable, consistent, and provable.

More about MERLINO

Deliver Advanced Purple Teaming as a Service

Move from Assumptions to Evidence
Realistic. Controlled. Fast.

Merlino is built for professionals who need speed and rigor. Use the integrated Morgana/Caldera option for controlled adversary emulation, or plug in your existing red-team method. Choose the delivery model that fits your client: fully managed, client-hosted, or shared-access SaaS — always with measurable results.

Getting Started with Merlino

Fast Validation, Real Evidence

Run targeted validation quickly — using your existing tests or the integrated Morgana/Caldera option. Merlino produces evidence you can show: what was tested, what worked, what didn’t, and what to fix next.

Works with Your Existing Stack

Merlino doesn’t replace your security tools. It connects to what you already use and structures the work around it — so your current SIEM/XDR investments become testable and improvable.

Threat Profiling & Exposure Review

Merlino starts from what matters: your real threats. It profiles adversaries, maps likely techniques, and highlights exposure and detection blind spots — so effort goes to the highest-impact gaps, not generic checklists.

A Repeatable Purple Team Workflow

Merlino standardizes the full workflow: profiling → mapping → validation → reporting. Less time coordinating tools, more time delivering results — consistently, across clients and teams.

Evidence-Based Coverage, Always Aligned

Merlino turns controls and detections into measurable evidence. Coverage is tracked against techniques and data sources, so alignment becomes continuous and auditable — without manual overhead.

Turn CTI into Defensive Action

Threat intelligence becomes a plan: prioritize techniques, define what to validate, and translate insights into concrete detection improvements — with clear outcomes and repeatable steps.

Merlino

Merlino is an operating method, not a product

Rethinking Cyber Intelligence for the AI Era