Skip to content

One feed. Every threat.

28,687+

Sources

327,559+

Articles

31,412+

Clusters

175,832+

Entities

How it works What's in the platform

As seen on

Associated Press ABC News CBS News International Business Times NOAH

How it works

From scrape to summary, in four steps.

What happens between a vendor advisory dropping and your analyst seeing it.

20,000+ sources, curated.

Vendor advisories, government CERTs, researcher blogs, national newspapers, dark-web leak sites, social platforms, and vulnerability databases. We monitor the whole open-source intelligence surface so your analyst doesn't have to.

Every source is graded: new ones are vetted before they join the feed, dead ones drop out.

Browse the source library
+13k

Thirty articles. One incident. One cluster.

The same incident gets written about by thirty outlets, each with a slightly different angle. Density-based semantic clustering groups them into a single record so you read the story once, not thirty times.

On a cluster page you get a sourced timeline, AI-generated summary and recommendations, the attack flow mapped to MITRE ATT&CK, the IOCs ready to export, every source article in line, and Ask AI grounded in the cluster's own content.

How the analysis is made
Cluster detail page

Sorted before you read them.

Every article enters a classifier that tags it against 17 threat categories. Whether it's a ransomware claim, a CVE disclosure, an APT campaign report, or a piece of geopolitical reporting, it lands in the right lane.

The feed is browsable by category, by sector, by region, or by time window.

See the live feed
APT Ransomware Vulnerability Malware Phishing Zero-Day Breach Geopolitical Critical Infrastructure Supply Chain Espionage DDoS AI Telecom & Internet Disinfo & Influence Drone & EW Insider Threat

21 entity types, extracted on the fly.

Threat actors, malware families, ransomware groups, CVEs, MITRE ATT&CK techniques, IPs, domains, hashes, email addresses, crypto wallets, tools, targeted industries, countries, platforms, vendors. Every cluster gets a structured entity layer the moment it lands.

Track a CVE across every cluster mentioning it. Watch a new APT group emerge as it's named in articles. Filter feeds by your tech stack. Trigger alerts when a tracked entity appears.

Browse the entity database

SHADOW-EARTH-053 Exploits Microsoft Exchange Vulnerabilities in Asia

The China-aligned threat group SHADOW-EARTH-053 has been exploiting unpatched Microsoft Exchange and IIS server vulnerabilities, specifically the ProxyLogon chain, to conduct cyberespionage. The group has targeted government ministries, defence contractors, and transportation entities across at least eight Asian countries and one NATO member state. Methods include deploying web shells and the ShadowPad malware via DLL sideloading and registry-based payload execution. Tools observed include Mimikatz and custom credential-theft utilities.

What this means in practice

A day of reading. An hour of decisions.

Around 900 articles a day become the one or two alerts that matter to you.

900 / day Raw articles ingested

From 20,000+ sources worldwide. Roughly 30 hours of reading.

~70 / day Clusters after deduplication

12.7 articles per cluster on average. ~92% noise removed.

5–10 / day Filtered to your world

Your sector, your stack, your geography, your supply chain.

1–2 / day Real-time alerts

High-impact matches that hit your inbox, Slack, or Teams the moment they land.

From collection to analysis.

Without clustering, the job is collection: reading the same story across ten outlets and deduplicating by hand. With ThreatCluster the day starts with entities extracted, sources consolidated and a threat score on every card, so the work is triage, assessment and response.

What's in the platform

Where there's a live surface, the card opens it.

Real-time Clustering

→

20,000+ sources aggregated continuously. Density-based semantic clustering groups related reporting. Thirty articles about the same incident become one cluster, not thirty alerts.

Entity Intelligence

→

Click any entity, get a full intelligence page. AI overview, recent events, threat profile, and a relationship graph mapping connections to other entities.

Custom Feeds

Build a feed in plain English, attach the entities you care about, and get hyper-specific CTI you can actually action. One feed per client, sector, or investigation, delivered to email, Slack, Teams, RSS or webhooks.

Smart Topics

→

Clusters grouped into the stories that are moving this week, so a topic page reads like a briefing rather than a search result.

ThreatCluster AI

Investigation assistant grounded in cluster content with inline citations on every claim. Six pre-built actions per cluster, plus free-form questions. Not the open web.

How the analysis is made

→

What on an incident page is generated, from which sources, the checks it passes, what still goes wrong, and how a record gets corrected.

Dark Web

→

In-house collection across ransomware and extortion leak sites. We scrape the sites ourselves, enrich every victim posting, and surface it alongside the rest of the threat picture.

Exploits

→

CVSS, EPSS, KEV status, public exploit availability, vendor references, related clusters, and X mentions in one view per CVE.

IOCs & Exports

→

Per-cluster or in bulk: TXT, CSV, JSON, STIX 2.1 bundles (with TLP), MISP feed, and ATT&CK Navigator layers. Filter by type, confidence, and time.

REST API

→

70+ endpoints over clusters, IOCs, entities, CVEs and the dark web. Free read-only key on every account, OpenAPI spec, scoped keys, STIX 2.1 out.

CLI & agent tools

→

Every capability reachable as a tc command or an agent tool. JSON-first, scoped agent keys, OS-keyring auth.

Want every feature in one table? See plans and capabilities → See the MSSP capability table or the IOC format matrix.

Behind ThreatCluster

Built by people who've worked the SOC night-shift and run intelligence for critical national infrastructure.

ThreatCluster started in February 2025 as a side project called Project Argus, built on a laptop in Bath: a clustering experiment that grouped open-source reporting by incident and pulled out the entities that matter. The prototype ran 67 feeds; the platform now monitors 20,000+ sources with the same idea at its core.

The core intelligence stays free, because threat intelligence should be reachable by everyone defending a network — we charge for the things that scale, like the API at volume, multi-tenant MSSP tooling and branded reporting.

James Mockford

James Mockford 🇬🇧

Founder & Managing Director

Security engineering background spanning defence consultancy, managed security, telecoms infrastructure, and critical national infrastructure including OT/ICS in the water sector. Petty Officer in the Royal Naval Reserve Maritime Cyber Unit.

Advisory partnerships

ThreatCluster co-publishes joint threat advisories with Defused (cyber deception and early warning). Partnerships like this bring complementary data sources into the platform where open-source scraping alone doesn't reach.

Defused Defused

Stop trawling. Start knowing.

One place for your threat intelligence. Free to start, no card required.

Open the Feed View Plans