One topic, everything about it.

ThreatCluster already groups related articles into clusters. Smart Topics go one level higher and group related clusters, by the entities they share, the actors they involve, the regions and sectors they touch.

The result is a row of pills above the feed that cuts the timeline by storyline. Click "Russian energy sector targeting", see every cluster that fits, in time order, with a short description of why those clusters belong together.

click to expand

Smart Topics ticker

The pill row above the feed, slowly scrolling. Click any to filter the feed to that storyline.

Smart Topics aren't a static taxonomy. The platform looks at recent clusters, finds groups that share enough entities to be the same broader story, and promotes them to a topic with a descriptive name.

New stories get new topics as they form. Topics that go quiet roll off. Static themes, "Russia", "Ransomware", "Zero-days", sit alongside as an always-on baseline; auto-detected topics are the week's narrative on top.

click to expand

Topic-grouping pipeline

Diagram: clusters → entity overlap → topic promotion → named pill in the feed.

Every pill carries the minimum metadata an analyst needs to triage at a glance, is this a story that's actually moving, or has it been sitting on the dashboard for a month?

Topics with declining velocity (current week below previous week) are filtered out of the ticker entirely. The pill row is reserved for stories with momentum.

• Trending, detected in both the 7-day and 30-day windows. Active baseline with fresh coverage.
• New, detected in the 7-day window but not 30-day. Something just broke.
• Broad, 50+ distinct sources reporting. Not a single-outlet scoop.
• Velocity %, cluster mentions this week vs the prior week.

Pick a topic and the feed reorganises around it. The first thing you see isn't a card, it's a short context strip: the topic's description, its source coverage (favicons of the outlets reporting it), and the same velocity % from the pill so the momentum is still in view.

Then the filtered feed underneath, in time order, with everything else, the entity filters, the view-mode toggle, the time window, still working on top of the topic cut.

click to expand

Topic header above the feed

Context strip: topic name, description, source favicons, velocity %, and a clear-X to drop the filter.

A morning scan of the feed isn't usually "what's the worst CVE today?", it's "what's moving today?" Threat actors don't drop a single article; they run campaigns that surface across thirty outlets over a week. Smart Topics surface those campaigns as a single click.

For analysts on rotation, it's a five-minute briefing. For MSSPs reporting up, it's the headlines for the executive summary. For researchers tracking a theatre, it's a saved filter that updates itself.

click to expand

Topic-filtered feed

Feed cards reorganised under a single topic, showing the entire campaign in time order.

• Real-time ClusteringThirty articles, one cluster.
• Entity IntelligenceProfile every actor, malware, CVE.
• Custom FeedsOnly the clusters that touch what you track.
• Dark Web MonitoringIn-house collection across leak sites and forums.
• Threat HuntingSIEM-ready queries per sector.
• ThreatCluster AIInvestigation assistant with inline citations.