Preprint tests structured corpus layer for cyber-intelligence agents

A preprint introduces CTIFoundry, a corpus scaffold for cyber-threat-intelligence agents built from CVE, CWE, CAPEC and ATT&CK cross-references, report entities and hybrid retrieval. The authors report that replacing only an agent's action surface with CTIFoundry increased overall F1 by 0.19 to 0.28 across four models and two providers on the public CTIConnect benchmark. On the stated Claude-model tests, the scaffolded agent used roughly half as many tool calls while improving accuracy.