A side project
that kept going.
ThreatCluster started in February 2025 as a side project called Project Argus, built on a laptop in Bath after too many years of watching the same problem go unsolved.
Threat intel that nobody can afford.
Every security team needs threat intelligence. Most can't afford it. The platforms that exist charge five or six figures a year, which means the only people who get decent visibility into what's actually happening are the organisations that already have the budget, the headcount, and the tooling to deal with it.
Everyone else reads blogs, checks Twitter, and hopes they catch the right advisory before it matters.
click to expand
Project Argus.
A clustering experiment. Take thousands of open-source articles, advisories, and reports. Group the ones covering the same incident. Pull out the entities that matter — threat actors, CVEs, malware, targeted industries, IOCs. See if the result looks more like intelligence than a news feed.
The early version ran 67 feeds through a Flask app on a local machine. The clustering used TF-IDF vectors and cosine similarity. It mostly worked. It sometimes didn't.
click to expand
The M&S cluster.
The prototype was handling real-world incidents. It pulled the M&S cyberattack together across a dozen sources that all described the same event in different words. The clustering was no longer a toy.
click to expand
The name changed.
The clustering engine had been rewritten twice. The entity extraction pipeline was producing structured output. The project needed a real name.
Project Argus became ThreatCluster.
click to expand
Building the platform.
PostgreSQL replaced flat files. The source list grew from 67 feeds to thousands. Semantic embeddings replaced TF-IDF. DBSCAN replaced the early similarity thresholds. Entity extraction expanded to cover 17 types.
The web app went from a Flask prototype to something you could actually log into. Dark web monitoring went live. The free tier launched alongside a Researcher tier and a Business tier. The first paying customers arrived.
click to expand
Reyben joined.
Reyben Cortes joined as co-founder, bringing experience from the U.S. Department of Homeland Security and hands-on threat intelligence work across government and APAC. The platform had outgrown what one person could build, maintain, and sell at the same time.
click to expand
Where we are.
ThreatCluster aggregates over 12,000 sources. The platform runs real-time clustering, attack flow generation mapped to MITRE ATT&CK, D3FEND countermeasures, public exploit tracking, SIEM-ready hunting queries, exposure management with CISA SSVC ranking, a reporting engine, dark web monitoring across ransomware leak sites and underground forums, and a CLI and REST API.
We co-publish joint threat advisories with Defused, Ransom-ISAC, and detections.ai. We've been quoted in Forbes. Our weekly threat briefs are read by security teams at organisations we never expected to reach when this was a script on a laptop.
click to expand
Why we keep the core free.
Threat intelligence should be accessible to everyone defending a network, not just the organisations that can write a six-figure cheque.
We charge for the features that scale — multi-tenant MSSP tooling, exposure management, branded reporting — and keep the core intelligence free.
The free tier is the same engine.
Sign up, no sales call. Same clustering, same entity extraction, same dark-web monitoring.