PolySwarm (NCT) is a decentralized marketplace that aims to bring changes to the detection, analysis, and response to cybersecurity threats. It utilizes blockchain technology to create a crowdsourced threat intelligence network. The platform uses an Ethereum ERC20 token, Nectar (NCT), as a means of acknowledging users who contribute valuable cybersecurity data and to access insights provided by the network. PolySwarm aims to support the development of new threat detection methods, where various solutions compete to detect threats and are acknowledged based on their performance.

PolySwarm operates as a decentralized threat intelligence market, powered by Ethereum smart contracts and blockchain technology. It aims to foster rapid innovation in the cybersecurity space by acknowledging accurate and timely threat intelligence. The platform's "Proof of Work" is threat detection accuracy, meaning the market acknowledges those who are most capable of defending enterprises and end users. PolySwarm uses NCT tokens as a means of acknowledging users who provide relevant cybersecurity data and using NCT to access insights provided by the network. The platform's operations are managed and executed entirely by distributed smart contracts.

PolySwarm aims to provide a more effective way to detect, analyze, and respond to the latest cybersecurity threats. It can be used by enterprises, consumers, vendors, and security experts to access and contribute to a global pool of threat intelligence. The platform's unique system acknowledges users who provide accurate and timely threat intelligence, making it a valuable tool for cybersecurity professionals. Additionally, PolySwarm seeks to lower the barrier to entry, provide broader coverage options, discourage duplicative effort, and ensure interoperability among products and threat intelligence feeds.

PolySwarm was developed by PolySwarm Pte Ltd, a company that received funding through the acknowledgment of Nectar (NCT) utility tokens. The platform was designed to address the inefficiencies and limitations of existing cybersecurity solutions. The founders of PolySwarm, who are also members of Narf Industries, LLC, a boutique information security firm, saw the potential of blockchain technology to bring changes to the cybersecurity industry. They leveraged their expertise in InfoSec, blockchain, and cryptographic research to create a decentralized marketplace for threat intelligence. Today, PolySwarm continues to evolve with the aim of contributing to the cybersecurity landscape.

PolySwarm strives to establish a decentralized threat intelligence market using blockchain technology. It acknowledges security experts and antivirus engines for their accurate and timely threat intelligence contributions to the network. This is achieved through a system of "micro-engines" developed by these experts, which autonomously investigate and analyze the latest threats. The performance of these micro-engines is measured based on their threat detection accuracy, and the market acknowledges those who are capable of defending enterprises and end users. This system not only encourages the participation of security experts but also aims to contribute to the overall cybersecurity landscape by fostering innovation and competition.

Unlike traditional solutions that are often siloed and lack compatibility, PolySwarm encourages collaboration and innovation in the cybersecurity space. It brings together enterprises, consumers, vendors, and geographically-diverse security experts in a single marketplace, fostering a real-time threat detection ecosystem. Security experts develop and maintain "micro-engines" that autonomously investigate the latest threats, striving to outperform their competition. The platform's "Proof of Work" is threat detection accuracy, rewarding experts who successfully defend enterprises and end users. This approach aims to make participation more accessible and provide a wider range of threat detection capabilities. It also discourages duplicative effort and seeks to facilitate compatibility among products and threat intelligence feeds. And, PolySwarm's use of blockchain technology and Ethereum smart contracts provides a platform for these interactions.

PolySwarm seeks to address the issue of false positives and false negatives in threat detection by establishing a decentralized threat intelligence market. This market encourages continuous improvement in the cybersecurity space with precise economic mechanisms that acknowledge timely and accurate threat intelligence. PolySwarm's "Proof of Work" is threat detection accuracy, meaning the market acknowledges experts who contribute to the defense of enterprises and end users. The platform employs a system of "micro-engines" developed by geographically diverse security experts. These micro-engines autonomously investigate the latest threats, striving for effective threat detection. PolySwarm also uses a process called "Mediated Consensus" to determine the accuracy of threat detection. This process entrusts a critical task to a subset of participants who are capable of undertaking the task. These participants are those whose actions are consistent with the overall health of the market. This approach aims to reduce the occurrence of false positives and negatives, seeking to improve the overall effectiveness of threat detection.

PolySwarm's threat intelligence services are designed with the intention of providing a different perspective on suspect file threat intelligence to a wide range of industries and sectors. These sectors include those that heavily rely on digital infrastructure and are at high risk of cyber threats, such as cybersecurity, finance, manufacturing, and energy. PolySwarm's services bring together mainstream existing anti-malware vendors, small companies, and independent experts worldwide. This is facilitated through a decentralized open market for suspicious file intelligence, supported by blockchain and smart contracts built on the Ethereum platform. Participants are acknowledged through PolySwarm’s own cryptocurrency, Nectar (NCT). This approach is designed to be suitable for companies and Managed Security Service Providers (MSSPs) with large volumes of incoming files, network traffic, or URLs, as they strive to obtain a near real-time verdict on the maliciousness of these files through PolySwarm’s automated marketplace.

PolySwarm employs a distinct method to ensure the quality and accuracy of threat intelligence data. It operates a robust network of threat detection engines that provide wide coverage against common threats. The key feature, however, comes from specialized engines that aim to detect threats earlier and catch emerging and rare threats that other engines often miss. These specialized engines are niche and research-driven, often authored by independent, well-known researchers and security teams, developing advanced threat detection methods. PolySwarm also uses a performance-based recognition system, powered by blockchain technology, that acknowledges researchers based on the accuracy of the threats reported. This creates a marketplace that aims to enhance cybersecurity efforts with improved speed and accuracy. PolySwarm uses a proprietary threat scoring algorithm, PolyScore, which rates the probability that a given file contains malware. It weights engines’ determinations based on previous performance, history with similar files confidence levels, and other indicators to produce a single, reliable score. This allows for improved decision-making and aims to limit incident response escalations.

Businesses and organizations can integrate PolySwarm's threat detection solutions into their cybersecurity infrastructure through various methods. One method is through the PolySwarm integration for Maltego, a cybersecurity software. This integration allows users to gain insights into malware by pivoting on any file hash, domain, or IP address. Users have the option to subscribe to a feed of recent malware detected by PolySwarm for detection and blocking. PolySwarm provides users with the option to upload, scan, and sandbox any malware sample on demand. Another method is through the integration with Anomali's ThreatStream, a threat intelligence platform. This integration enables threat analysts to access information on trending malware from a single pane-of-glass. PolySwarm's threat detection solutions can be integrated through its APIs for malware threat intelligence directly on relevant industry platforms.