iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
SpyCloud announced AI Insights for its Investigations solution on August 6, 2025. The enhancement was designed to help analysts find patterns in identity exposure data from breaches, malware and infostealer infections, and phishing campaigns. It builds on IDLink, SpyCloud’s identity-correlation capability; it did not introduce Research Agent, which SpyCloud announced later, on June 24, 2026.
What AI Insights does in SpyCloud Investigations
SpyCloud describes Cybercrime Investigations as identity-centered investigation software, available through an AI-powered SaaS console or an API. Its public materials say the product correlates exposure information from breaches, malware and infostealer infections, and phishing campaigns. In its 2025 announcement, SpyCloud said AI Insights applies investigative methodologies to historical information to surface suspicious behavior, identity patterns, and potential insider-threat signals. These are vendor descriptions, not independently validated performance findings. SpyCloud’s August 6, 2025 announcement
The feature is best understood as an analysis layer that can help practitioners find and interpret signals across exposed identity data. It is not a guarantee that a given pattern proves malicious activity or identifies a responsible person. Analysts still need to assess findings in context.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →How IDLink, AI Insights, and Research Agent fit together
The product lineup has changed since AI Insights was announced. SpyCloud’s current product page presents three capabilities as layers in an investigation workflow: IDLink correlates identity data, Research Agent plans investigation pivots, and AI Insights identifies patterns and attribution signals and prepares finished intelligence. SpyCloud says reports can be exported in narrative, table, or report form. SpyCloud Cybercrime Investigations
#1 Best Overall
| Capability | Role described by SpyCloud | Timing |
|---|---|---|
| IDLink | Automatically correlates identity data, including connections through identifiers such as usernames, email addresses, passwords, and personal information, according to SpyCloud. | Announced October 10, 2024. SpyCloud’s IDLink announcement |
| AI Insights | Finds patterns and potential risk signals in investigation data and helps prepare intelligence. | Announced August 6, 2025. SpyCloud’s AI Insights announcement |
| Research Agent | Accepts a question, hypothesis, or batch of assets and plans investigation pivots; SpyCloud says findings can be traced to specific records and reviewed in the console. | Announced June 24, 2026. SpyCloud’s Research Agent announcement |
Research Agent should not be conflated with the 2025 AI Insights launch: it was announced in 2026 as a later addition. SpyCloud says its AI Insights models draw on the Investigations team’s tradecraft and expertise and do not include customer data in the algorithms. That is the company’s data-handling statement, not an independent audit finding. Likewise, the company describes Research Agent findings as traceable to records; that description does not itself establish external verification of the system.
What analysts can use it for
SpyCloud lists threat actor attribution, infected-host identification, financial crime analysis, supply-chain exposure, insider risk, identity exposure, synthetic identity analysis, and employment fraud among Cybercrime Investigations use cases. It identifies cyber threat intelligence, security operations, fraud and risk, and incident-response practitioners as potential users. The product page describes these use cases; whether a capability fits a particular investigation depends on the available data, the question being asked, and the analyst’s validation.
Insider-risk investigations
AI Insights was announced in part as a way to surface identity patterns and possible insider-threat signals. Such a signal is a lead for investigation, not a conclusion that an employee acted improperly. Organizations should apply their own authorization, privacy, and evidence-review procedures before taking action.
Recommended Free Tools
Exposure and cybercrime investigations
Correlating identities across breach, malware, and phishing information can help investigators connect records that would otherwise be reviewed separately. SpyCloud’s 2024 IDLink announcement described linking results through shared identity attributes; AI Insights was presented later as a way to identify patterns in investigative data. IDLink announcement AI Insights announcement
Rank #3
- Students build unmatched deductive-reasoning skills as they become crime-solving stars
- Most scenarios have more than one plausible outcome, allowing individuals or groups to broadly interpret evidence
- Includes interpretive handwriting, body language, fingerprinting, and many more activities
Console or API: which option fits?
SpyCloud positions the Investigations Module and API for different workflows. Its public product page does not publish price comparisons, so selection is better based on how a team needs to investigate and operationalize results.
| Consideration | Investigations Module | Investigations API |
|---|---|---|
| Working style | Guided, analyst-facing console for investigations and review. | Programmatic access for teams building custom integrations or workflows. |
| Desired output | Finished intelligence and reports, which the product page says can be exported in narrative, table, or report form. | Enrichment and data for custom automation and downstream systems. |
| Best fit | Analysts who want a dedicated investigation interface. | Teams with engineering or automation capacity that need to incorporate investigation data into their own tools. |
| AI feature availability | SpyCloud’s current FAQ says Research Agent and AI Insights are available on Pro licenses. | The public product page does not state a separate API entitlement for those features; confirm availability and licensing with SpyCloud. |
For the current product details and licensing language, consult SpyCloud’s Cybercrime Investigations page.
Rank #4
What SpyCloud’s published numbers do—and do not—show
SpyCloud’s August 2025 announcement cited a figure of 56% of organizations experiencing an insider-threat incident in the past year, attributing it to a 2025 survey of CISOs and security practitioners. The announcement does not state the sample size, field dates, geography, question wording, or methodology. Treat it as a vendor-reported survey result, not an independently established prevalence rate. Source: SpyCloud, August 6, 2025
In its June 2026 Research Agent announcement, SpyCloud reported a corpus of more than 1 trillion recaptured identity assets. It also described a “typical result” versus exact-match queries alone: 8× more identity records, 14× more plaintext passwords, 5× more linked emails, and 2× more malware infections. The announcement does not provide the comparison sample or methodology, so these are vendor-reported figures, not independently interpretable benchmarks. Source: SpyCloud, June 24, 2026
Availability and evaluation questions
SpyCloud’s current Cybercrime Investigations page says Research Agent and AI Insights are available on Pro licenses. The public materials cited here do not list prices. Before evaluating the product, a team should clarify which capabilities its proposed license includes and whether it needs the console, API, or both.
- Which investigation sources and identity attributes are available for the organization’s intended use?
- Can findings be reviewed back to source records in the team’s required workflow?
- Which outputs are available through the selected license and interface?
- What controls and internal review steps will govern use of possible insider-risk signals?
These questions distinguish the product’s advertised workflow from what a specific team can access under its deployment and license.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
