Who and why
Which adversaries target organisations like yours, and what they want.
Coming soon
Make threat intelligence
relevant to your environment.
Connect threat indicators and exploit context to your assets and findings. Help security teams focus on relevant exposure and give responders context for their next decision.
Intelligence review
Intelligence source
Relevant indicator
Asset relationship
Investigation context
01 / Select sources
Define relevant intelligence inputs.
- Source requirements
- Indicator scope
Discuss sources and indicator types that matter to your environment.
02 / Relate assets
An indicator needs application context.
- Asset reference
- Finding relationship
Evaluate how intelligence should relate to assets and existing findings.
03 / Inform review
Agree how intelligence changes a decision.
- Investigation question
- Evaluation criteria
Define the context needed to make prioritisation more useful.
Feeds
Open and custom sources
STIX/TAXII, MISP, KEV, EPSS, NVD.
Match
IOC matching
Against findings, alerts and assets.
Exploit
Exploit context
Known exploitation will re-rate severity.
Fresh
Feed health
Stale feeds will raise alerts.
The category
What is threat intelligence?
Threat intelligence comes in three layers. The common failure is collection without action: feeds pile up in a separate console while the vulnerability backlog is ranked without them. A threat intelligence platform earns its place by deduplicating sources, scoring confidence, and matching every indicator against the assets and findings you actually own.
Strategic
Operational
How campaigns work
The campaigns under way and the MITRE ATT&CK techniques they rely on.
Tactical
What to match
Machine-readable indicators, exploited-vulnerability catalogues and exploit-prediction scores. This is the layer SecurityVault is designed to act on.
The design
Which sources will SecurityVault use, and what does each add?
All sources will land in one store with deduplication and confidence scoring.
| Source | What it adds |
|---|---|
| STIX/TAXII and MISP | Indicators of compromise and campaign context from sharing communities |
| CISA KEV | Vulnerabilities confirmed as exploited in the wild |
| EPSS | The probability that a vulnerability will be exploited in the near term |
| NVD and exploit databases | Vulnerability detail and public exploit availability |
| Malware hash lists | Known-bad file hashes |
| Your analysts | Organisation-specific indicators with tags, notes and expiry dates |
Correlation
What will happen when intelligence matches your estate?
Intelligence is a lens, and it needs something to look at. SecurityVault is designed to apply it directly to the graph that already links code, artefacts, cloud and identity.
Every image re-rated
A dependency CVE that appears in a known-exploited catalogue will be re-rated at once in every image and workload that carries it. Read using SBOMs to find which images shipped a new CVE.
The exact resource
An indicator that matches an address or domain in your inventory will point to the exact resource involved, not a log line to chase.
Campaign cases
Co-occurring signals that match a known campaign's MITRE ATT&CK techniques will open a campaign case that links every affected asset.
Fresh risk scores
Intelligence will attach to findings rather than copy them, and a change in intelligence will trigger a fresh risk score and, through your fail-closed deployment gates, a fresh release decision.
Feed health
Each feed will be tracked against its expected cadence, with an alert raised when it falls behind, so stale intelligence will not pass for current.
FAQ
Threat intelligence questions.
- Which threat intelligence sources will SecurityVault ingest?
- The design covers STIX/TAXII feeds, MISP events, the CISA Known Exploited Vulnerabilities catalogue, EPSS exploit-prediction scores, the NVD, exploit databases and malware hash lists, plus indicators your own analysts create.
- What is the difference between threat intelligence and vulnerability management?
- Vulnerability management finds and fixes weaknesses in what you run. Threat intelligence tells you which of those weaknesses attackers are actually exploiting, and which indicators of attack to look for. Combined, a finding can be ranked by real-world threat, not only by its base score. See vulnerability management.
- What happens when a feed stops updating?
- Feed freshness is a first-class signal in the design. A feed that falls behind its expected cadence will raise an alert instead of quietly serving stale intelligence, so a broken feed is never mistaken for a quiet threat landscape.
- Can I add my own indicators?
- That is part of the design. Analysts will create, tag and annotate organisation-specific indicators with expiry dates, and they will be matched alongside feed indicators.
- When will threat intelligence be available?
- Threat intelligence is in development. Discuss the feeds, indicators and investigation context you require as we define the threat intelligence rollout.
Available today: vulnerability management · SCA and SBOM · attack surface management. Further reading: risk-based vulnerability management and reachability. Related offerings: detection and response. Built for SOC and incident response teams.
Discuss your requirements
Tell us which feeds you rely on.
Tell us which intelligence sources and asset relationships would help your analysts investigate relevant threats.