RiskProfiler Launches MCP Connector to Integrate External Threat and Exposure Intelligence with AI Assistants

Introduced ahead of BSides Ahmedabad, the new connector enables authorized users to investigate exposures, vendor risk, identity threats, and security operations through natural-language questions

Ahead of BSides Ahmedabad, RiskProfiler announced the RiskProfiler MCP Connector, introducing a conversational way for security teams to access and investigate intelligence from across their organization’s external risk landscape.

Security teams routinely work across dashboards, modules, filters, reports, and exported data to understand changes in their attack surface, assess third parties, investigate credential leaks, and identify threats to their brands. The new RiskProfiler MCP Connector provides an additional interaction layer that allows users to begin with the question they need answered.

Through a supported AI assistant, authorized users can ask natural-language questions such as “What changed in my attack surface this week?” “Which vendors require attention today?” or “Does this leaked credential still pose a risk?” The assistant interprets the query, retrieves relevant intelligence from the organization’s RiskProfiler environment within the user’s permitted access, and presents the findings to help teams investigate and prioritize potential threats. The connector will launch with Claude support, with integrations for ChatGPT and Gemini planned for later phases.

Secure, Conversational Access to Security Intelligence 

The Model Context Protocol (MCP) provides a standardized way for AI assistants to connect with external systems and data sources. Within RiskProfiler, it enables an assistant to access and interpret security intelligence from a customer’s environment while adhering to established permissions and access controls. Rather than relying solely on general cybersecurity knowledge, the assistant can respond using information relevant to the organization’s own risk landscape, based on the data and integrations available to each authorized user.

The connector changes the starting point of the workflow. The connector allows users to begin with a natural-language question and move directly into understanding context, investigating findings, and determining an appropriate response. The workflow here moves naturally from posting a query to understanding the context, investigating the threat intelligence, and enabling informed actions. 

The RiskProfiler MCP connector complements the platform’s existing dashboard and agentic AI workflows by providing an additional, conversational access to threat intelligence. With the implementation, RiskProfiler will remain the source of organizational threat data, while the AI assistant simplifies the interaction process with the data for authorized users.

“Security teams need to move quickly from identifying a potential issue to understanding its relevance to the business. Giving analysts a conversational way to explore external risk intelligence can reduce the time spent navigating disparate data and help them focus on investigation, prioritization, and informed action,” said Setu Parimi, CTO and Co-Founder of RiskProfiler. 

Connecting threat context across external risk domains

The RiskProfiler MCP Connector is designed to help users work across several areas of external threat exposure management without treating each signal as an isolated record.

For external attack surface and vulnerability intelligence, a team could ask what new internet-facing assets, exposed services, or critical findings appeared during a particular period, and which issues may require attention first. Third-party risk teams might need information on which vendors have the highest risk stakes in their supply chain, which assessments are overdue, or whether a supplier’s posture has recently changed.

Brand and digital-risk investigations can begin with questions about suspected phishing infrastructure, lookalike domains, open takedown activity, or other threats associated with an organization’s online identity. Dark-web and credential monitoring can be extended through follow-up questions intended to establish whether an exposed credential still represents a meaningful risk.

Where relevant data and integrations are available, users may be able to examine whether the associated account remains active, whether its password has changed since the exposure, and whether multifactor authentication is enabled. This adds identity context to the original exposure signal and can help teams determine which cases warrant investigation first.

The connector can also surface operational information related to Trust Center activity, security questionnaires, assessments, and incidents. A user could ask which questionnaires remain outstanding, who has requested access to Trust Center materials, or what open incidents require attention.

Turning Daily Security Activity into Clear Priorities Across the External Risk Landscape

One example introduced as part of the launch is the request, “Give me my morning security briefing.”

Rather than opening several RiskProfiler module dashboards separately, an authorized user can request a prioritized summary of relevant activity across the organization’s available security intelligence. Depending on the customer’s data and enabled capabilities, the briefing would include material changes to the attack surface, newly identified findings, vendor-risk developments, brand and domain threats, credential or identity exposures, questionnaire activity, and other operational items requiring review.

The purpose is not simply to aggregate alerts. It is to help a user understand what changed, why it may matter, and where investigation should begin.

The same approach can support entity-centric investigations. For example, an analyst could ask, “What does RiskProfiler know about this domain?” RiskProfiler can then bring together the relevant exposure, domain, digital-threat, credential, and third-party context available within that customer’s environment. Follow-up questions can help the analyst narrow the issue without restarting the investigation in each underlying module.

From autonomous investigation to conversational intelligence

The MCP Connector builds on RiskProfiler’s recently launched KnyX Autonomous Investigation. KnyX deploys specialized AI agents to investigate threat signals, collect and correlate structured evidence, produce confidence-scored verdicts, and support remediation according to customer-defined policies. This supports a shift from reviewing disconnected indicators toward examining the context and relationships that determine whether a signal requires action.

The MCP Connector complements that capability by making the resulting intelligence easier to explore conversationally. Analysts and decision-makers can initiate an inquiry, request a summary, examine a finding, and ask follow-up questions through a supported AI assistant. This creates a more accessible path into investigations while preserving RiskProfiler as the underlying intelligence platform.

The distinction is important: MCP provides the interaction layer, while RiskProfiler and its agentic AI module, KnyX AI, provide the security intelligence and investigation context. AI-generated responses are intended to assist qualified users, not replace analyst judgment or established review and response procedures. By reducing manual navigation and making cross-domain context easier to examine, the connector can help analysts investigate findings more efficiently and give security leaders a clearer view of changes and priorities across their external risk landscape. 

Supporting AI-assisted security operations

As AI assistants become part of analyst and executive workflows, security platforms need ways to make operational intelligence accessible within those environments without separating it from its source or governance controls.

For security teams, the practical value lies in reducing manual navigation and shortening the path from a question to usable context. For security leaders, it can provide a clearer way to review changes and priorities across multiple risk domains. For analysts, it offers another method of exploring relationships between exposures, identities, vendors, domains, and active security operations.

Customers, partners, and BSides Ahmedabad attendees can visit us at Booth B14 for more information and demonstration of the RiskProfiler platform.

About RiskProfiler

RiskProfiler is an external threat intelligence platform that brings together external attack surface management, third-party risk management, brand protection, dark-web monitoring, vulnerability intelligence, cyber threat intelligence, identity risk management, compliance management, and domain protection.

RiskProfiler’s AI agents work together to investigate risk signals, analyze threat signatures, correlate relevant intelligence, prioritize findings according to business and operational impact, and streamline response. By connecting intelligence across security domains, the platform helps organizations move from isolated signals toward informed investigation and action.

Explore how RiskProfiler helps you secure your external attack surface against a fast-evolving threat landscape. Learn more at riskprofiler.io.