Merlino · Excel add-in
Threat understanding, inside Excel.
Merlino brings threat intelligence, organisational context and validation scope into an Excel workspace. Build a Threat Profile, understand relevant behaviours and define what should be validated.
What you can do
A threat workspace in the spreadsheet you already know
Merlino uses Excel tables as its working data model, driven by MITRE ATT&CK technique IDs. It is an analysis and orchestration client — not a SIEM, scanner or execution engine.
- Understand relevant threats
Import MITRE ATT&CK and security-control data, and relate records through technique IDs.
- Assess context
Capture organisational context and exposure to focus on what actually matters.
- Review coverage & gaps
Calculate coverage and see where defences are missing against relevant behaviours.
- Define validation scope
Build a Catalogue and Validation Packages that describe what should be validated and why.
- Produce explainable reports
Generate adaptive reports that explain relevance, coverage and priorities.
- Stay in one tool
Everything lives in Excel — tables, picks, Smart View and analysis stay together.
The handoff to Morgana
WHY and WHAT stay traceable
When operational validation is planned, Merlino's Threat Profile, Catalogue and Validation Packages provide the traceable rationale. A synchronisation action shares scope and metadata — it does not, by itself, execute tests.
Learn about MorganaAssessment
Assess your organisation inside Merlino
Complete a guided assessment in Merlino to capture your organisation's context and identify relevant threat scenarios. Generate a traceable Threat Profile, build your validation scope and carry it into Morgana for operational testing.
- 1Capture context
Record organisational context, critical assets and relevant technology in a dedicated Assessment workbook.
- 2Answer core questions
Complete core questions and the applicable specialist inputs for your environment.
- 3Generate a Threat Profile
Validate answers and produce a Threat Profile with rationale, relevance and confidence — kept distinct.
- 4Build validation scope
Turn that context into an ATT&CK-linked Catalogue and Validation Packages.
- 5Pass it to Morgana
Hand the scope to Morgana for planning, then review the resulting evidence.
The structured method stays deterministic:Answer → Signal → Threat Scenario → ATT&CK Technique. AI assists interpretation; structured assessment logic keeps priorities traceable. An assessment is not an automatic vulnerability scan or a guarantee of security.
How Morgana runs the validation →AI in Merlino
AI in your threat intelligence workflow
Merlino combines assessment and AI-assisted threat analysis inside Excel. AI supports interpretation while structured logic keeps priorities traceable.
Bring selected workbook context into an AI-assisted analysis of threats and coverage.
Run defined, repeatable analysis steps against your data instead of one-off prompts.
Turn results into readable explanations and AI-assisted report narratives — reviewed by the analyst before use.
AI uses configurable providers and is never a requirement: several workflows run without a cloud model, and every result stays yours to review.
Get Merlino
Get Merlino for Excel
Merlino is a free custom Office add-in, installed through Excel's “Add from URL” path using the official production manifest.
Requirements at a glance
- Excel 2016 or later, Microsoft 365 Excel Desktop, or Excel on the web.
- Office Add-ins enabled, and HTTPS reach to the official deployment.
- Custom add-ins may depend on Microsoft 365 tenant policy.
Start in a new or fully backed-up workbook before loading a template — template loading replaces existing sheets. Exact menu labels vary by Excel release.
Learn more