VulnCheck Launches Canary Intelligence to Provide Verified Evidence of Active Exploitation

VulnCheck Launches Canary Intelligence to Provide Verified Evidence of Active Exploitation

First-party telemetry from live, intentionally vulnerable systems gives security teams real-time proof of exploitation for faster, more confident vulnerability response

VulnCheck , the exploit intelligence company, today announced the launch of Canary Intelligence, a new product that provides first-party, validated exploitation data from vulnerable systems deployed around the world, enabling defenders to prioritize faster, patch smarter and stay ahead of breaches.

VulnCheck continuously observes exploitation within these intentionally vulnerable systems, providing customers with early indicators of real-world exploitation activity. Unlike traditional reporting based on honeypots or second-hand data, each event captured by Canary Intelligence contains verified data on the attacking host, the targeted CVE and the payload used.

“Canary Intelligence replaces speculation with certainty,” said Jacob Baines, CTO, VulnCheck. “Security teams can now confirm which vulnerabilities are being exploited in the wild, by whom, and with what payloads. This verified telemetry enables organizations to prioritize remediation and detection based on real-world attacker behavior, not observed attempts or theoretical severity scores.”

VulnCheck Canary Intelligence enables security teams to:

VulnCheck recently published a report showcasing Canary Intelligence in action, documenting how the product detected active exploitation of XWiki CVE-2025-24893. The findings detail a two-stage attack chain that delivers a coinminer via a template-injection vulnerability. The tool not only confirmed the exploitation chain and infrastructure, but also provided concrete indicators defenders can use to identify related activity quickly and effectively.

Today, VulnCheck Canaries have observed exploit activity for 231 VulnCheck KEVs, 20 of which had no prior publicly reported exploitation evidence. VulnCheck Canary Intelligence also includes in-the-wild detections of more than 500 CVEs, just over 230 of which are on CISA KEV.

All events captured by Canary Intelligence are ingested, enriched, and integrated into VulnCheck’s broader suite of intelligence products, including VulnCheck KEV, Exploit and Vulnerability, and IP Intelligence datasets, providing unified and comprehensive visibility across the platform. Verified exploitation data from the new product is also available through API, UI and machine-readable data streams, ensuring seamless intelligence ingestion into existing tools, workflows and products.

VulnCheck Canary Intelligence is now generally available. For more information on the new product and other capabilities, visit .

VulnCheck VulnCheck is the exploit intelligence company helping enterprise, global government organizations and cybersecurity vendors respond to new vulnerabilities and emerging threats faster with more context. Trusted by the world's largest organizations, VulnCheck protects hundreds of millions of systems and people worldwide, enabling them to outpace adversaries with threat intelligence solutions purpose-built for machine-level consumption and response actioning at scale. VulnCheck’s threat intelligence offerings equip teams with comprehensive, real-time exploit and vulnerability intelligence, first-party attack visibility and essential detections that are autonomously correlated and machine-readable, enabling emerging threat response in software vs human analysis. Follow the company on or X .

Jason Vancura Marketbridge for VulnCheck vulncheck@marketbridge.com

View source version on businesswire.com:

The articles, information, and content displayed on this webpage may include materials prepared and provided by third parties. Such third-party content is offered for informational purposes only and is not endorsed, reviewed, or verified by Morningstar.

Morningstar makes no representations or warranties regarding the accuracy, completeness, timeliness, or reliability of any third-party content displayed on this site. The views and opinions expressed in third-party content are those of the respective authors and do not necessarily reflect the views of Morningstar, its affiliates, or employees.

Morningstar is not responsible for any errors, omissions, or delays in this content, nor for any actions taken in reliance thereon. Users are advised to exercise their own judgment and seek independent financial advice before making any decisions based on such content. The third-party providers of this content are not affiliated with Morningstar, and their inclusion on this site does not imply any form of partnership, agency, or endorsement.