Threat Intelligence
🟠 High - significant impact, exploitation reported or likely.
🟡 Medium - moderate impact.
🔵 Low - limited impact.
⚪ Informational - context only.
Severity reflects what the source actually reports - the platform never arbitrarily labels an item "Critical".
High - government/cert-grade source (CISA, NCSC, NVD, ENISA, MSRC).
Medium - single or secondary source; verify before acting.
Unknown - verify with the original source.
The platform never claims certainty when attribution is uncertain.
Active exploitation means a credible source (CISA KEV, NCSC, vendor advisory) reports the vulnerability being exploited in the wild. The Known Exploited Vulnerabilities (KEV) catalog is CISA's list of CVEs with confirmed exploitation. These items get the highest-priority treatment - treat them as "patch immediately".
Threat actor profiles are built from public, credible reporting. Attribution is shown only when supported by sources and always carries a confidence label. The MITRE ATT&CK view maps reported activity to tactics and techniques (Initial Access, Execution, Persistence, Credential Access, Lateral Movement…), and the threat map shows which techniques are active in current intelligence.
Threat actors → MITRE ATT&CK →Every intelligence item is scored for relevance to you: country matches (+30), industry matches (+20), watchlist technology matches (+15), plus boosts for KEV and critical severity. The dashboard ranks the highest-scoring items under Threats relevant to you, and each item shows why it matters on its detail page. Configure your country, industry and technology subscriptions on the Watchlists page to make this list accurate.