Cortex organization boundaries determine what an analyzer API key can access

Cortex analyzes observables for security teams and can hold API keys for external services, connect to TheHive, and store organization-specific configuration, making a Cortex login a route into a shared analysis supply chain. Its API keys perform organization-level operations, where the role determines the permitted action but the organization determines the data and configuration reachable. Keeping integration keys dedicated, limiting analyzer configuration to a small support role, and rotating provider credentials when administrators leave are recommended safeguards. Outbound network access from Cortex to external analysis services should also be reviewed, since a compromised analyzer setup could leak observables or act as a request proxy. Per-organization rate limits and quotas are treated as security controls to prevent one tenant from disrupting others' investigations.