Threat intelligence: Cyble signs a three-year MoU with Kerala Police
Cyble, an AI-native cybersecurity company, has signed a three-year Memorandum of Understanding (MoU) with Kerala Police to strengthen cybercrime investigations and threat intelligence, through its Indian subsidiary, Cyble Infosec India Private Limited. The agreement supports the Kerala Police Cyber Operations wing and Cyberdome, the state police’s cyber centre of excellence, in identifying and investigating emerging cyber threats.
The scope is broad. Cyble will provide intelligence relevant to investigations — compromised credentials, ransomware activity, data leaks, phishing and fraud infrastructure, and the impersonation of government and police brands. The MoU also covers no-cost evaluation access to select Cyble platforms, training for officers in open-source intelligence (OSINT) and dark web investigations, joint research into emerging threats such as AI-enabled fraud, deepfakes, mule account networks and investment scams, and public awareness initiatives. The MoU does not say what happens at the end of its three-year term.
“We aim to help investigators access relevant threat intelligence, strengthen their investigative capabilities, and better understand emerging threats targeting citizens and institutions,” said Beenu Arora, Co-Founder and CEO of Cyble. Ankit Asokan, IPS, of Kerala Police, said the collaboration would support Cyberdome and its officers with relevant intelligence and strengthen investigative capabilities.
The model behind it
The MoU extends a model Kerala Police has built over years. Kerala Police conceived Cyberdome as a high-tech public-private partnership centre, bringing together government departments, academia, industry, ethical hackers and international law enforcement to handle cybercrime proactively. It operates a security operations centre and, according to Kerala Police, was the first state police department in India to implement an AI-powered integrated security platform, built with C-DOT’s TRINETRA.
Cyberdome describes itself plainly as a model of public-police cooperation and not a commercial entity; its more than 2,500 volunteers are not paid. It has signed similar no-remuneration agreements before: an MoU with NIT-Calicut in 2024, for instance, covered advanced cybercrime investigation and let metadata flow to research under non-disclosure safeguards, with no disclosure of evidence. In that light, the Cyble agreement fits a familiar template: a police force that lacks in-house capacity reaches for outside expertise, and the partner contributes on favourable terms.
Value to Kerala
Cyberdome’s value to Kerala has been that it multiplies the state’s capacity without a large budget line. That is a deliberate design choice. By keeping the centre non-commercial, Kerala Police can take contributions from many vendors without favouring one, and its volunteers can work on cases without a commercial relationship in the way. Bringing in a single vendor’s threat intelligence does not break that design, but it tests it. The template has limits as well as strengths. A police force that depends on outside expertise for threat intelligence is only as current as its partners’ feeds, and it takes on the risk that its investigative priorities start to track a vendor’s product roadmap. Kerala Police has addressed part of that by keeping Cyberdome non-commercial and volunteer-driven, so that the centre’s own analysts, not a supplier, decide what matters.
Cyble brings real capability to that template. Its portfolio spans Cyble Vision, a threat intelligence and digital risk protection platform; Cyble Blaze AI, an agentic AI layer; and Cyble Titan, endpoint security. Gartner named it a Challenger in the 2026 Magic Quadrant for Cyberthreat Intelligence, its first inclusion, and it ranked No. 576 on the 2026 Inc. 5000, with annual recurring revenue more than tripling in just over two years.
Why now: cybercrime’s industrial turn
The urgency behind the MoU is easy to document. Cybercrime in India has become organised and industrial in scale. The Ministry of Home Affairs reports that, under the I4C’s financial-fraud reporting system, authorities have saved more than ₹11,158 crore across more than 32.8 lakh complaints up to 30 June 2026. A Suspect Registry has flagged 32.08 lakh Layer-1 mule accounts and declined transactions worth ₹25,698 crore. The MHA is itself using AI to keep pace, including suspect scoring for mule accounts with IIT Bombay and the RBI Innovation Hub’s Mulehunter.ai tool.
That industrialisation changes what intelligence is for. Investigators once needed it to reconstruct a fraud after the fact; now they need it to find the mule accounts, phishing domains and deepfake pipelines before the next victim is targeted. The MHA’s own tooling points the same way, with AI-assisted mule-account scoring and dark-web monitoring. A state police force that can see the infrastructure early can disrupt a network rather than chase its proceeds; one that cannot is left responding to complaints. Threat intelligence, in this model, is a preventive tool as much as an investigative one.
The threat categories Cyble will work on are the ones driving that rise. AI is upgrading existing crimes rather than inventing new ones: voice cloning, deepfake videos, synthetic extortion material and attempts to defeat Aadhaar-based biometric verification have all appeared in recent Indian cases, and the IT Rules were amended in February 2026 to address synthetically generated information. Police linked a deepfake-based fraud in Surat to complaints totalling about ₹9.84 crore.
For a State Force
For a state force, timely threat intelligence on these networks makes the difference between investigating a crime after it happens and spotting the infrastructure before criminals use it. The scale is hard to overstate: a single mule-account crackdown in Telangana this year arrested 101 people and traced more than 1,100 crime links across India, showing how far one fraud network can spread. Against that, a police force’s own intelligence is rarely enough on its own.
The commercial question
Here the model gets more complicated. The MoU includes no-cost evaluation access to select Cyble platforms — a benefit to the police, and a commercial on-ramp for the vendor. That is a normal sales motion, but it sits uneasily beside Cyberdome’s stated identity as a non-commercial public-police cooperation centre. If evaluation access becomes a paid contract later, the arrangement shifts from a contribution to procurement, and the disclosure standard changes with it. For the model to hold, the disclosure has to match the dependence. There is a governance dimension to that dependency. If threat intelligence becomes essential to daily policing, the terms on which a state obtains it — price, data and continuity — become a matter of public interest, not just procurement.
Cyberdome’s strength has been that its partners contribute on non-commercial terms; a shift toward paid intelligence would be reasonable, but it would also change how the centre accounts for what it uses. The vendor benefits too, in ways that are legitimate and worth stating plainly: a state-police reference strengthens Cyble’s position in a growing public-sector market, and no-cost evaluation access is a standard way to earn it.
There is a data question too. The release does not say whether Kerala Police shares any data with Cyble, or how it would govern such data. Cyberdome’s NIT-Calicut agreement handled this carefully, with non-disclosure clauses and a prohibition on sharing evidence. A threat-intelligence vendor works in the opposite direction, ingesting data to produce intelligence, so the safeguards matter as much as the capability. None of this makes the partnership improper; it means the value of the model depends on terms the release does not disclose.
What to watch
For Kerala Police, the test is whether the MoU produces investigations that would not otherwise have happened, and whether Cyberdome keeps its non-commercial character as commercial partners multiply. For the sector, the Kerala experiment is a template worth watching: it shows how a state can borrow commercial capability without buying it outright, and whether that borrowing scales as threats grow. And, for Cyble, the Kerala deal is a reference in a growing public-sector market. For the state more broadly, the Kerala model is one of several: other forces have built their own cyber bureaus and signed their own vendor agreements, while the MHA centralises much of the shared infrastructure.
Whether states converge on Kerala’s public-private approach or on in-house capacity will shape how threat intelligence reaches the officer who needs it. For citizens, the question is whether the intelligence translates into fewer frauds — and whether the data that flows to fight crime gets the same care as the data that flows to commit it.
What the announcement does and doesn’t establish
It establishes a three-year MoU, its scope, and the parties to it. It does not establish a value, a procurement, or any measure of what the partnership will change. Moreover, it does not say whether Kerala Police shares data with Cyble, how it would protect it, or whether the no-cost evaluation leads to a paid contract. And it does not quantify outcomes, because there are none yet to quantify. What it does establish is that Kerala Police is willing to bring commercial intelligence into a centre built on volunteer and non-commercial contributions, and that a global vendor sees a state police force as a market worth serving.
The honest summary is that Kerala Police has extended a public-private model that has served it well to a commercial threat-intelligence vendor, against a cybercrime landscape that justifies the urgency. The model’s value will turn on terms — value, data and duration — that the announcement leaves unstated.