A side project that kept going.
ThreatCluster started in February 2025 as a side project called Project Argus, built on a laptop in Bath after too many years of watching the same problem go unsolved.
- February 2025
Threat intel that nobody can afford
Every security team needs threat intelligence, and most can't afford it. The platforms that exist charge five or six figures a year, so the only people with decent visibility into what's happening are the organisations that already have the budget and the headcount to handle it.
Everyone else pieces it together from blogs and Twitter, hoping to catch the right advisory before it matters.
- February 2025
Project Argus
A clustering experiment: take thousands of open-source articles and advisories, group the ones covering the same incident, and pull out the entities that matter, threat actors, CVEs, malware, targeted industries and IOCs. Then see whether the result looks more like intelligence than a news feed.
The early version ran 67 feeds through a Flask app on a local machine, clustering with TF-IDF vectors and cosine similarity. It mostly worked, though not always.
67 feeds · Flask · TF-IDF · cosine similarity
- May 2025
The M&S cluster
The prototype was handling real incidents. It pulled the M&S cyberattack together across 12 sources that all described the same event in different words. The clustering was no longer a toy.
- June 2025
The name changed
The clustering engine had been rewritten twice. The entity extraction pipeline was producing structured output. The project needed a real name, and Project Argus became ThreatCluster.
- Late 2025
Building the platform
PostgreSQL replaced flat files. The source list grew from 67 feeds to thousands. Semantic embeddings replaced TF-IDF, DBSCAN replaced the early similarity thresholds, and entity extraction expanded to cover 21 types.
The web app went from a Flask prototype to something you could actually log into. Dark web monitoring went live. The free tier launched alongside a Researcher tier and a Business tier, and the first paying customers arrived.
PostgreSQL · embeddings · DBSCAN · 21 entity types · dark web · paying customers
- Early 2026
Reyben joined
Reyben Cortes joined as co-founder, bringing experience from the U.S. Department of Homeland Security and hands-on threat intelligence work across government and APAC. The platform had outgrown a single founder doing the engineering and the selling at the same time.
- Today
Where we are
ThreatCluster aggregates over 20,000 sources. The platform runs real-time clustering, attack flow generation mapped to MITRE ATT&CK, D3FEND countermeasures, public exploit tracking, SIEM-ready hunting queries, a reporting engine, dark web monitoring of ransomware leak sites, and a CLI and REST API.
We co-publish threat advisories with Defused, Ransom-ISAC and detections.ai. We've been quoted in Forbes. Our weekly threat briefs are read by security teams at organisations we never expected to reach when this was a script on a laptop.
Why we keep the core free
Threat intelligence should be reachable by everyone defending a network, including the teams that can't write a six-figure cheque.
We charge for the things that scale, the multi-tenant MSSP tooling and the branded reporting. The core intelligence stays free.
More about the platform
- Real-time clusteringThe engine everything else grew around
- Dark web monitoringRansomware leak-site tracking
- Every capabilityThe full feature index
About ThreatCluster FAQ
What is ThreatCluster?
A real-time threat intelligence platform that clusters reporting from over 20,000 sources into one record per incident, with entity extraction, exploitation tracking, dark-web monitoring, hunting and reporting on top.
Why is the core tier free?
Because threat intelligence was priced out of reach for most of the people who need it. The free tier is the same engine as the paid tiers; we charge for the features that scale, such as multi-tenant MSSP tooling and branded reporting.
When did ThreatCluster start?
In February 2025, as a clustering experiment called Project Argus built on a laptop. It became ThreatCluster in mid-2025 and has grown into the current platform.
Do you work with other threat intelligence organisations?
Yes. We co-publish advisories with Defused, Ransom-ISAC and detections.ai, and run partnerships with researchers, educators, non-profits and CERTs.
How do I get started?
Sign up for the free tier, no card required. Paid tiers and partnership access are available for teams that need more.
The free tier is the same engine.
Sign up, no sales call. The free tier runs the same clustering, entity extraction and dark-web monitoring as every paid plan.