Your All-in-One
Cyber Threat Investigation Tool
InCyter brings 30+ analyst tools together in one dark-themed desktop app, and adds a local AI assistant that reads your analysis. No cloud, no telemetry, no cost.
Windows 10 / 11 x64 · nothing else to install
Real screens, real results
Every screen below is the actual application analysing a real domain. Nothing is mocked up.
Everything starts here
A live CISA Known Exploited Vulnerabilities ticker and a threat feed aggregated from CISA, ACSC, BleepingComputer, The Hacker News and Cyber Security News, newest first.
Paste any indicator into the search bar and InCyter works out whether it is an IP, domain, URL, hash or CVE, then opens the right scanner with it already filled in.
Email security, scored
A spoofability score out of 100 with the reasons behind it, an inbox simulation, and the policy broken down tag by tag. The scorecards summarise impersonation, privacy and branding at a glance.
Here microsoft.com scores a clean 100: DMARC at reject, SPF hard fail, DKIM present, and both TLS-RPT and MTA-STS enforced. The InCyter Intelligence badge marks findings from InCyter's own rule-based engine, running locally and offline.
It finds what a checker misses
SPF allows only ten DNS lookups, and redundant entries quietly burn through
them. InCyter expands every include:, resolves who owns each
range, then reports what is authorised twice and what is already covered by
something larger.
On vmware.com it works through
197 authorised entries and catches a /16 that already covers a
single address listed separately. Computed, not estimated.
Advice you can actually act on
DKIM Key Health assesses the published keys rather than counting them: key
length, revoked selectors, and t=y testing mode, which tells
receivers to ignore DKIM failures so a domain looks configured while enforcing
nothing.
Across adobe.com's eight selectors it flags five worth knowing about, and the advice changes per key. It spots which ones are delegated to a mail provider by CNAME and therefore not yours to change, and it warns that under a reject policy a botched rotation bounces mail.
It explains itself, and it shows restraint
Static analysis with nothing executed. InCyter reads the signature, the imports, the sections and the resources, then says in plain English what the file is and what it can do, mapped to MITRE technique IDs.
The scoring is shown, not hidden. Here a high-entropy resource and an anti-debug import are noted, then discounted because the file carries a valid trusted signature, so it lands at low risk instead of crying wolf.
The whole ATT&CK matrix, built in
709 Enterprise techniques across every tactic column, searchable including sub-techniques. Click any technique for its description, detection guidance and mitigations, or open it full screen.
The Toolkit also holds bulk scanning, IOC extraction from text, PCAPs and OCR, an encoder and decoder, a JWT decoder, a Sigma rule generator and a regex tester.
An analyst sitting beside your analysis
InSentri docks to the side of InCyter and reads whatever you have open. Ask it a plain question and it answers about the screen in front of you, citing the actual record: the reject policy, the hard fail, the enforcement percentage.
It runs on your own hardware and is off by default. This screen shows it using a model served by a local Ollama install, which InCyter never installs or starts for you.
You choose where it runs
Use the bundled model for a fully offline assistant, or point InSentri at an Ollama server you already run and use any model you have pulled into it.
The built-in model keeps working either way, so if the server is not running you are one click from falling back to it.
From IOC to Insight in Seconds
Drop an IP, hash, email or file. InCyter figures out what it is and runs the right checks automatically.
Paste or Drop Any IOC
An IP, domain, URL, file hash or email, or drag a file straight in. The smart search bar detects the type and routes it to the right scanner.
Instant Multi-Source Scan
Up to eight threat intelligence sources queried at once, with static analysis running locally on your machine at the same time.
Investigate, Note & Export
Colour-coded verdicts, analyst notes, redirect chains and MITRE ATT&CK techniques, then a TLP-classified HTML report in one click.
Everything a SOC Analyst Needs
Seven investigation modules covering the full threat analysis workflow, from first triage to detailed malware inspection.
IOC Scanners
Scan hashes, IPs, domains and URLs against multiple threat intelligence feeds. Defanged indicators are normalised automatically before scanning.
Toolkit
Extract IOCs from raw text, PCAPs and images via OCR. Run bulk scans, search MITRE ATT&CK, decode payloads and generate Sigma rules.
Malware Analysis
Static analysis without executing anything. PE and MSI with full certificate-chain review, ZIP, Office macros, PDF structure, browser extensions, YARA and fuzzy hashing.
Encrypted Files
Identifies the encryption format and reads everything available from the header without the key, across PGP, Office, PDF, ZIP, 7-Zip, RAR, BitLocker, S/MIME, SSH keys and PKCS#12.
Email Analyser
Parse raw headers for SPF, DKIM and DMARC results and routing anomalies. Scan the body across 14 threat categories, then extract and scan every IOC.
Domain Tools
WHOIS, TLS certificates and passive DNS, plus a full email-authentication analysis with a spoofability score, SPF duplicate detection and DKIM key health.
InSentri AI
A local AI assistant that reads the analysis page you have open, so you can ask about the file, domain or email in front of you. Runs on your own hardware, off by default, and can use your own Ollama models.
CVE / Vuln Intelligence
Look up any CVE from NIST NVD: CVSS scores, EPSS probability, CISA KEV flags, affected software and MITRE ATT&CK mappings in one view.
InCyter Intelligence
The badge you see beside verdicts. InCyter's own rule-based engine, running locally and offline. Not a language model and it does not guess: when it says thirteen duplicate ranges, it computed that and can name every one.
17 Threat Intelligence Sources
Keys are stored encrypted on your machine and never sent anywhere else. Free-tier keys work for most day-to-day analysis, and InCyter works without any of them.
VirusTotal
File, hash, IP, domain and URL across 70+ engines.
API KeyHybrid Analysis
Falcon Sandbox detonation and hash lookup.
API KeyAlienVault OTX
Threat pulses, IOC reputation and attribution.
API KeyAbuseIPDB
IP abuse confidence with ISP and report history.
API KeyANY.RUN
Interactive sandbox for files and URLs.
API KeyShodan
Open ports, services, banners and CVEs per IP.
API KeyGreyNoise
Internet background noise and scanner reputation.
API Keyurlscan.io
URL scanning, screenshots, DOM and DNS analysis.
FreeScamAdviser
Domain and URL trust scoring and fraud detection.
Freeipinfo.io
IP geolocation, ASN and hosting provider lookup.
FreeNIST NVD
CVSS, affected software and patch references.
FreeCISA KEV
Known exploited vulnerabilities feed.
FreeMITRE ATT&CK
Enterprise technique data, cached locally.
FreeCloudflare DNS
1.1.1.1 resolver for DMARC, SSL and passive DNS.
Freefilescan.io
Extra URL and file detection coverage.
FreeMISP Galaxy
Threat actor and malware clusters, bundled in-app.
OfflineWindows OCR
Built-in OCR for image and scan text extraction.
Offline20+ Features Need No Internet
Air-gapped environment? Disconnected investigation? These run entirely on your local machine.
Start Investigating Smarter
InCyter is free forever and installs in under a minute. No account, no subscription, no telemetry.
Windows 10 / 11 x64 · No Python required
If your anti-virus blocks the download: InCyter is not yet signed with a code-signing certificate, so some products flag new installers on sight. Download the exe version instead as a workaround.