Threat intelligence, scoped to your sector
Every sector is targeted by different groups, through different infrastructure, under different rules. These pages cover what that looks like for the industries we get asked about most, and the same data is one API call away. Every account mints a free key: 100 credits a day over the last 7 days, no card.
Sector pages
Each one covers what makes the sector's threat model different, the suppliers and platforms worth watching, and the frameworks you are assessed against.
| Sector | What we track |
|---|---|
| Healthcare | Hospitals, payers, labs and medical device makers. |
| Financial services | Banks, fintech and payment infrastructure. |
| Defence | Contractors and the cleared supply chain. |
Every other sector we track
Live threat activity for other sectors — active clusters, associated groups and the latest reporting:
Over the API
Sector scoping is a query parameter, not a product tier. Incidents mentioning a sector come back from the threats endpoint, and ransomware leak-site victims filter by sector directly. Base URL is https://threatcluster.io/api/public/v1, authenticated with an X-API-Key header.
Incidents mentioning a sector
curl -H "X-API-Key: $TC_KEY" \ "https://threatcluster.io/api/public/v1/threats?keyword=healthcare"
Leak-site victims in a sector
curl -H "X-API-Key: $TC_KEY" \ "https://threatcluster.io/api/public/v1/darkweb/ransomware/victims?sector=Manufacturing"
The free key covers every read endpoint over the last 7 days with 100 credits a day. Starter at $7.99 a month raises that to 1,000 credits with full records and all history; Business from $199 removes the daily budget. The full breakdown is on the pricing page and every endpoint is in the API docs.
Start with your sector
Create a free account, mint a key and make the first sector-scoped call in a minute. No card, no procurement.