One feed. Every threat.

-

Sources

-

Articles

-

Clusters

-

Entities

Trending clusters, updated live

What happens next

Every cluster is enriched automatically. Here's what the AI extracts from your articles.

Every name. Every IOC. Every threat actor.

Our Entity Engine extracts 17 entity types from every article - threat actors, malware families, CVEs, IP addresses, domains, companies, countries, MITRE ATT&CK techniques, ransomware groups, tools, and more.

APT29 CVE-2026-3055 LockBit 203.0.113.50 T1566.001 Microsoft Russia Cobalt Strike evil-c2.net CVE-2025-32975 Yanluowang T1059.001 Phishing Ransomware Healthcare PowerShell Windows
Key Points
  • -Critical zero-day actively exploited in the wild since January 2026
  • -Affects NetScaler ADC and Gateway versions 13.1 and 14.1
  • -CVSS 9.3, pre-authentication remote code execution via SAML

A critical out-of-bounds read vulnerability in Citrix NetScaler ADC and Gateway products allows unauthenticated remote attackers to execute arbitrary code via specially crafted SAML requests...

Read in seconds, not hours.

ThreatCluster AI reads every article in the cluster and generates a concise summary with key points. No jargon, no filler. Just what you need to know and why it matters.

See how events unfolded.

ThreatCluster AI reconstructs a chronological timeline from all sources. See when the vulnerability was disclosed, when exploitation began, when patches dropped, and what happened between.

March 20, 2026
Vulnerability CVE-2026-3055 disclosed by Citrix
March 21, 2026
Arctic Wolf confirms active exploitation in the wild
March 22, 2026
CISA adds to KEV catalog, emergency patch released
March 23, 2026
Proof-of-concept exploit published on GitHub

Features

Explore

Track emerging campaigns, malware families, and threat actors. Identify trends before they hit the news cycle.

Custom Feeds

Track 30,000+ unique entities and custom keywords. Set up webhooks, notifications, and email digests.

Tagging

Tag clusters for easy organisation and categorisation. Build your own taxonomy on top of the feed.

Workflows

Create custom automation workflows triggered by keywords, thresholds, or schedules. Connect to Slack, email, webhooks, and more.

MCP Server

Connect ThreatCluster to Claude Desktop and Claude Code. Search threats, pull IOCs, and generate queries from your AI assistant.

API Access

Full REST API with 23 endpoints. Search, IOC export, entity lookup, trending data. 120 requests per minute.

MISP Feed

Standard MISP feed with IOC context, threat level mapping, and TLP markings. Drop it straight into your MISP instance.

Collections

Save clusters into personal or shared collections. Organise by incident, campaign, or client engagement.

Report Builder

Generate threat briefs in 6 styles. Add your logo for white-labelled output. Export to PDF or share via link.

What ThreatCluster solves

"Are we affected?"

A major incident drops. Leadership wants answers. ThreatCluster clusters every source covering it in real time, extracts the CVEs, products, and threat actors involved, and gives you the full picture in one place instead of two hours of trawling.

"I missed something."

Set keywords for your stack, your industry, your threat actors. ThreatCluster watches thousands of sources so you do not have to. When something relevant appears, you know.

"The report takes longer than the research."

Pick your clusters. Generate a threat brief. Export it. The weekly reporting that used to eat half a day takes minutes.

Who is ThreatCluster built for

SOC Teams

Related incidents, actor history, CVEs, and IOCs in one cluster. Context in seconds, not 30 minutes.

Threat Intel Analysts

Automated collection from thousands of sources. Entity extraction, actor timelines, and IOC feeds built as data arrives.

CISOs and Security Leaders

Trending threats by industry, severity scoring, and AI-generated executive briefs. Board-ready in minutes.

MSSPs

Filter by sector, generate white-labelled reports, and run org-scoped workflows across your client base.

Incident Responders

Mid-incident context. Related campaigns, actor TTPs, and IOCs already clustered. Less pivoting, faster decisions.

Vulnerability Management

Track CVEs from disclosure to active exploitation. Know which ones matter to your stack before the scanner tells you.

Red Teams and Pen Testers

Current TTPs by actor and industry. Real-world attack chains to inform engagement scoping and scenario design.

OT and ICS Security

Track threats to industrial systems, SCADA, and critical infrastructure. Filter by ICS-specific malware, actors, and CVEs.

Defence and Government

Nation-state actor tracking. Campaign timelines. Geopolitical threat context. STIX and IOC feeds for existing tooling.

Stop trawling. Start knowing.

Join thousands of security professionals who get their threat intelligence from one place. Free to start, no credit card required.