Warnings from national cyber agencies
UK NCSCCERT-EU
Official threat reports and security advisories are checked every 15 minutes.
Threat intelligence
See which threats matter to the systems you run.
SecurityAlert matches your assets, technology, and user accounts to relevant threat actors, vulnerabilities, ransomware activity, and indicators. Each priority includes the information your team needs to understand why it is there.
895 actor profilesMITRE ATT&CK groups plus reviewed ransomware and open-source intelligence.
390,664 CVEsLocal NVD mirror enriched with KEV, EPSS, ransomware, and ATT&CK context.
56 threat campaignsCampaign timelines, attributed actors, targets, sources, and related research.
23 live publisher feedsChecked throughout the day and joined with 5 structured intelligence datasets.
Source coverage
New threat reporting, collected throughout the day
SecurityAlert keeps the publisher, original link, publication time, and collection time with every item. Official advisories and established research carry more weight than community posts.
Reporting that helps confirm a developing story
BleepingComputerThe Hacker NewsDark ReadingSecurityWeek
Headlines are retained with their original source and never presented as first-party findings.
Technical research from established teams
Google Threat IntelligenceUnit 42SentinelLABSElasticESETRapid7
Research is connected to known actors, campaigns, CVEs, malware, and techniques when the evidence supports it.
Structured records and coordinated disclosures
NVDCISA KEVFIRST EPSSMITRE ATT&CKabuse.chCERT/CC
These sources supply vulnerability, exploitation, technique, and indicator context beyond general reporting.
Get security advisories straight from the vendor
Microsoft MSRCCitrixCisco PSIRTPalo Alto PSIRTFortinet PSIRTIvantiDelineaUbuntu SecurityAWS Security
We keep the advisory ID, severity, affected products, CVEs, dates, and fix guidance, then match each update to the technology you watch.
Early discussion, kept separate from verified reporting
Reddit r/netsec
Community posts can surface a lead, but they cannot establish attribution or prove that your environment is affected.
Relevant threats
Why a threat appears on your list
SecurityAlert only marks a threat as relevant when it can connect that threat to information about your environment. Activity in your industry is still useful, but it is shown as background rather than as a finding about your company.
Threats connected to your environment
See which of your assets, technologies, or accounts connects to a CVE, threat actor, indicator, or ransomware report.
One profile for each threat actor
Review names, relationships, campaigns, victims, infrastructure, malware, tools, techniques, CVEs, and dated activity in one place.
Follow a campaign from first sighting to current activity
Review the timeline, attributed actors, targets, and source material. Actor-level CVEs, techniques, malware, and indicators are clearly labeled as context.
What raises a CVE's risk
Compare CVSS with CISA KEV, EPSS probability, known ransomware use, affected software, actor links, ATT&CK techniques, and recent activity.
Ransomware groups and their victims
Follow leak-site operators across two sources. SecurityAlert merges duplicate reports and keeps observed dates separate from dates claimed by an operator.
Security events tied to an account
Match authorized directory details with events for a specific account. Unattributed domain-wide counts are shown separately as background.
Find domains on related infrastructure
Search our registrant, WHOIS, passive DNS, and nameserver data, then watch that infrastructure for newly registered domains.
Explain what your team cares about
Add your important technologies, regions, suppliers, and threat priorities. Verified assets still decide whether a threat affects you.
Watch a narrow question over time
Monitor campaigns, actors, CVEs, malware, sectors, or indicators by keyword and condition, then see exactly what changed.
Build the update your audience needs
Save evidence as you investigate, add an analyst conclusion, and require review before a briefing can be delivered.
Public research
Investigate a threat without leaving the site
Our public catalog includes permanent actor and CVE pages, ATT&CK views you can filter by industry, free research tools, sourced news, WHOIS, and infrastructure searches.
Actor catalog
Research a threat actor
Browse current and historical actors, including their aliases, targets, ATT&CK techniques, relationships, infrastructure, malware, and activity.
Browse threat actors → Campaign catalogSee the activity connected to a campaign
Browse named campaigns, their dates, targets, attributed actors, source material, and related actor intelligence.
Browse threat campaigns → Vendor advisoriesCheck the latest vendor security bulletins
Search official advisories by vendor, product, CVE, advisory ID, and severity, then open the original bulletin for the final fix guidance.
Browse vendor advisories → Security newsFollow current reporting and SecurityAlert research
Search headlines from established security publishers and read our source-backed analysis on the same page.
Browse security news → CVE intelligenceCheck which vulnerabilities are being exploited
Start with trending and known-exploited vulnerabilities, then review the software, actors, ransomware groups, and ATT&CK techniques connected to each one.
Explore CVEs → Ransomware trackerSearch ransomware groups and claimed victims
Search current and historical victim reports by group, country, industry, or organization. We label uncertain dates instead of presenting them as exact.
Open the ransomware tracker →Integrations
Connect SecurityAlert to the tools your team uses
Public catalog endpoints do not require a key. Private feeds and agent tools follow the same permissions and audit rules as the dashboard.
MCP
Look up SecurityAlert data from an AI client
Use read-only tools to query exposure, indicators, actor data, registrants, findings, and proposed actions.
Read the MCP guide → REST APIBuild an internal integration
Use scoped API keys, OpenAPI 3.1, and documented endpoints for findings and indicator lookups.
Open the API reference → Feeds and alertsSend alerts where your team will see them
Choose Slack, Teams, email, signed webhooks, STIX 2.1, TAXII 2.1, MISP-shaped events, or RSS.
See integrations →You can explore our threat data for free.
Research campaigns, actors, CVEs, ransomware activity, ATT&CK, security news, and investigation tools. A Business workspace connects that research to your environment and lets you monitor, investigate, and brief your team.