ThreatFeed
v4.2
Created by
Jerry Craft
ALM, CISSP, GSEC, GPEN, GCFE
ThreatFeed reads the security news and vulnerability data every day so you don't have to. It pulls articles from curated security feeds, extracts the CVEs, breaches, threat actors and attacker tools they mention, maps them to MITRE ATT&CK and ATLAS, and adds exploit intelligence for every CVE. Each morning it writes a daily digest of what mattered, and it builds weekly, monthly, quarterly and annual reports with charts, timelines and sources.
It is built for security leaders, SOC analysts and IT teams who need to know what changed, what is being exploited, and what to do about it, without reading hundreds of articles.
About the Creator
Jerry Craft has spent more than 30 years leading technology and security work, from the server room to the boardroom.
He began his career at Farmers & Merchants Bank of Long Beach as a bank teller and rose over nearly 18 years to First Vice President, Assistant CIO and Chief Information Security Officer. As a member of the bank's IT and executive leadership teams, he directed enterprise security and digital transformation. His Network Services organisation won multiple Department of the Year awards, and he kept a consistent record of protecting the institution from breaches while modernising its infrastructure.
At RSM US LLP he managed the West Coast Penetration Testing and Forensics practice. His team of ethical hackers delivered penetration testing, digital forensics and incident response for regional banks, hospitals, universities and SaaS providers across the United States, Canada and international markets.
Since 2012 he has been the lead penetration tester and virtual CISO at Nth Generation Computing. As a vCISO he serves 8 to 15 organisations at a time across finance, healthcare, education, manufacturing, retail, entertainment, government and shipping, covering security budgets, third-party risk, board reporting and multi-year roadmaps. As lead penetration tester he does the hands-on work himself: network, cloud, web application and API testing, and security testing of AI and LLM applications for prompt injection, data leakage and authorization bypass.
Builder and developer. Jerry writes the software he uses. His GitHub spans more than 20 projects in Python, R, Go, JavaScript and SQL: security tooling, data analysis, machine learning, web platforms and embedded Raspberry Pi systems.
- Crimson, named for Harvard, is an autonomous exploitation platform he developed while at Harvard. It takes vulnerability scan data and scores every host with machine learning models (k-nearest neighbours, random forest and gradient boosting). It classifies systems by role so domain controllers and servers are targeted before printers and workstations. It maps vulnerabilities to known exploits through Exploit-DB, then drives Metasploit to select exploits and payloads from a learned experience database and attack systems without manual intervention. Guardrails let an operator step through, abort or run fully autonomously. Data analytics produce risk graphs, outlier detection and written reports, and ThreatFeed's live exploit intelligence boosts targeting toward what attackers are actually using.
- ThreatFeed is a full threat intelligence platform he designed and built alone: more than 1,400 commits and 60,000 lines of Python, SQL, JavaScript and HTML. It covers feed collection, AI enrichment on a self-hosted language model, CVE and exploit intelligence, MITRE ATT&CK and ATLAS mapping, agentic AI investigations, five tiers of automated reporting with charts and PDFs, email delivery, and the web platform itself.
- Other projects include Nessus scan parsers and visualisation tools, data analysis in R, and a Raspberry Pi solar monitoring system.
He holds an ALM in Information Management Systems from Harvard University, a Graduate Certificate in Cybersecurity from Harvard Extension School, and a BA from California State University, Long Beach. He is certified as a CISSP and a GIAC Security Essentials (GSEC), Penetration Tester (GPEN) and Certified Forensic Examiner (GCFE). He speaks regularly on cybersecurity.
Free and Members
Free, no account needed
- The daily threat intelligence digest
- The daily digest archive
- The dashboard of current articles and alerts
- CVE search with exploit and KEV status
Members
- Weekly, monthly, quarterly and annual reports with charts and timelines
- PDF downloads of every report
- Any digest delivered by email, PDF attached
- Exploitation Radar, Attack Paths and breaking alerts
- Threat actor, attacker tool, breach, industry, vendor and MITRE explorers
- AI threat investigations and trend analysis
- White labeling: your company's logo on every page, matched to your email domain
Tech Stack
Backend
Python / Flask / Gunicorn
Database
SQLite
AI
Ollama / Qwen3.6-35B, self-hosted - no cloud model in any lane
Frontend
Jinja2 / HTMX / Chart.js
CVE Enrichment
NVD / VulnCheck / EPSS
Deployment
Render.com
Data Sources
Security news - curated RSS/Atom feeds from security publications, researchers and vendors
NVD - CVE severity, CVSS v2/v3 scores, CWEs
VulnCheck - KEV status, exploit maturity, CVSS v4, ransomware links, ATT&CK mappings
CISA KEV - the Known Exploited Vulnerabilities catalog
FIRST EPSS - 30-day exploit probability and percentile scores
Microsoft MSRC - security update advisories
Metasploit Framework - CVE-to-exploit module mappings
Exploit-DB - public exploits by CVE
MITRE ATT&CK - adversary technique mappings
MITRE ATLAS - techniques for attacks on and with AI systems
Version History
v4.2
Current - November 2026
- New address: ThreatFeed is now at threatfeed.live, with the old address still working
- The daily digest and its archive are free to read with no account, and each daily digest has its own shareable page with a title, summary and link preview for LinkedIn and other sites
- Weekly, monthly, quarterly and annual reports rebuilt in one consistent format: an executive summary, the period's critical vulnerabilities, major incidents, threat actor activity, emerging trends, AI-related threats and recommended actions
- Charts in every report tier: activity over the period, per-100-article rates, top threat actors, most-hit industries and a timeline of major incidents, plus a key figures panel and a Sources section linking claims back to their articles
- Daily digests now carry a Sources section too: each company, threat actor, CVE and incident the digest names is numbered and linked to the original articles that reported it, earliest first, with the publication and date. Events named by what happened ("wallet drain", "crypto heist") are matched to their articles by the name of who was hit
- A full year of weekly, monthly and quarterly reports regenerated in the new format, so the archive reads the same from end to end
- Digests by email: choose any tier on Options and each one arrives with its executive summary and the full PDF attached, with one-click unsubscribe in every email
- Daily emails can skip weekends, when there is little new to report; this is the default
- Forgot password from the login page, with a single-use reset link that expires in an hour
- Change password from Options; changing it signs out every other session on every device
- Breach metrics now cover the whole archive, with record and cost totals and a 24-week trend
- A "What's new" notice on the dashboard for announcements like this one, dismissed once per reader
v4.1
August - October 2026
- AI CVE action plans: a clear patch now, mitigate or watch verdict for a CVE, with what to look for in your environment and the steps to take
- AI vendor risk briefs, with a risk rating pill on every briefed vendor and a filter to find the riskiest
- AI sector briefs on industry pages: the sector's risk level, its top threats, the actors targeting it, and what defenders there should prioritise, refreshed weekly for busy sectors
- AI detection guides on attacker tool pages: how the tool behaves and how to spot it in your environment
- AI attack path briefs for breaches, reconstructing how an attacker got in and moved, and a searchable Attack Paths page covering every breach reported across multiple articles
- A monthly Threat Actor Briefing on the most active groups, published automatically, with a homepage button and an archive of past briefings
- The annual digest tier, completing daily, weekly, monthly, quarterly and annual reporting
- Digests are written as soon as their data is in, rather than at fixed hours
- PDF exports match their web pages
- Investigations reworked for accuracy: the AI is given its sources and the cluster's real signals, every report is validated before it is stored, severity, confidence and evidence count are calculated rather than guessed, and up to 15 articles feed each investigation
- A shareable link on every investigation, and a PDF of any investigation for every signed-in member
- Threat actor accuracy: merged names stay merged, and actor counts reflect only what the articles actually say
- Breach accuracy: actor tags come only from linked articles, and records describing one incident under different names are merged, with a likelihood score for each proposed merge
- CISA Known Exploited Vulnerabilities synced weekly, and CVEs mentioned in article bodies linked automatically
- More dependable news intake: one failing feed can no longer stop collection, and publish dates feeds format badly are repaired
- Rebranded in Harvard crimson
- Executive statistics on the dashboard, drawn from the digests and weighted for an executive reader
- Every page reorganised into titled sections, with full phone layouts and a complete dark mode
- An "About this page" box on every page linked from the dashboard, explaining what it shows and how to read it
- White labeling for any organisation: a company's own logo appears in the banner of every page, including the digests and their archives, for every member whose email address is on that company's domain. Logos are matched to email domains automatically and managed from a dedicated administration page, so any organisation can be onboarded with its own branding, and members from other organisations never see it
- Dates and "today" follow your own timezone, detected from your browser
- Branded error pages, and a plain explanation when a form has expired
- CVE search opened to everyone
- A public read-only API: digest teasers and feed, the quarterly briefing, recently exploited CVEs and a site summary
- Faster access requests: AI-assisted vetting, clear-cut requests approved automatically, and signup links sent by email
- Verified database snapshots, with damaged backups detected and removed
v4.0
- Fully self-hosted AI: article enrichment, cluster narratives, every digest tier, investigations, service recommendations and entity cleanup all run on a self-hosted Qwen3.6-35B model, and no article or report is ever sent to a cloud AI service
- MITRE ATLAS alongside ATT&CK: attacks on AI systems, such as prompt injection, model and RAG poisoning and agent context poisoning, and attacks carried out with AI now map to a real technique instead of landing in a generic bucket like phishing. The full 170-technique matrix is browsable, showing what has been observed and, just as usefully, what never has
- ATT&CK's own AI technique, T1588.007 (adversaries obtaining generative AI), recognised and recorded alongside the ATLAS technique
- Cleaner threat actor and attacker tool lists: the AI resolves names that rule-based matching cannot, such as "Medusa" the RAT against "Medusa" ransomware, combined names like "AISURU/Kimwolf", and version numbers, and only high-confidence merges are applied
- Uncertain merges go to a review page that shows exactly what each merge would change before it is approved
- Microsoft security advisories added to CVE coverage, including the Linux kernel, Chromium and other third-party CVEs Microsoft tracks
- New articles are enriched within minutes of publication, and a digest never waits behind the article backlog
- No work is lost to an interruption: results are held and resent until the site accepts them, and stalled investigations are picked up again automatically
- Login protection against password guessing now holds across every server and survives restarts
- AI-written report fields are escaped before display
v3.8
- AI threat investigations moved to the self-hosted model's own tool-using research loop, completing the move started in v3.7
- Every AI task, from enrichment and cluster narratives to all digest tiers and investigations, now runs with no cloud dependency
- Daily production health check with an at-a-glance status badge for administrators: green when healthy, red only for real errors
- Breach data quality tools: duplicate breaches reported under different organisation names merged, misplaced industry labels normalised, and records re-enriched to recover missing financial-impact figures
- Feed audit page gains a "Fetch Now" button to pull a single feed on demand
- Threat actor directory deduplicated by name, showing each actor's dominant type, and industry trend details now match the industry list exactly
v3.7
- Article enrichment, cluster narratives and every digest tier (daily, weekly, monthly and quarterly) now written by the self-hosted model
- Self-hosted model upgraded to Qwen3-14B
- Digest generation moved onto a job queue, so a model can be swapped or upgraded without changes to the site
- More reliable generation for long reports: longer time limits, automatic recovery of stalled jobs, and a queue estimate on the status page
- The AI chat assistant retired after low use
- Investigation engine evaluated on the self-hosted model against existing reports before cutover
v3.6
- Hybrid AI: article enrichment moved from a cloud AI service to a self-hosted Qwen2.5-14B model running around the clock
- Secure by design: the AI system makes only outbound, authenticated connections to ThreatFeed and accepts none inbound
- Every enrichment records which model produced it, for quality comparison and provenance
- One shared path for saving enrichment results, whichever model produced them
- Administrator view for spot-checking AI output: article, tokens, errors and raw results
- Synthesis and investigation tasks stayed on the cloud model at this version, pending evaluation
v3.5
- CVE intelligence API for Crimson, the author's autonomous exploitation platform, with token-based authentication
- Metasploit module database: 2,600+ CVE-to-exploit mappings, refreshed weekly from the Metasploit Framework
- Metasploit badge on CVE search results for CVEs with a known exploit module
- One-click Metasploit sync for administrators, with live statistics
- Full NVD coverage: 340K+ CVEs searchable
- CVE enrichment every 10 minutes
- Export and import of CVE intelligence for air-gapped networks, so Crimson can use ThreatFeed's intelligence offline from a USB drive
v3.4
- Analyst Briefing page: a shift-start intelligence view of active threat clusters, quick stats and recent investigations
- Intelligence-focused dashboard redesign with executive threat briefings, breach, CVE, MITRE and tool metrics, and investigation summaries
- Nation-state activity chart: top threat actor nations with 90-day trend indicators
- Investigation types chart: campaign, actor, breach, CVE, malware and tool investigations
- Investigation links open straight to the investigation, expanded
- Breach industry reclassification and consolidation for cleaner analytics
- Duplicate investigations of the same target removed
- Consistent crimson card styling across every page
- Simplified Options page
v3.3
- Breaking alert clusters investigated automatically on a schedule
- AI model upgraded for enrichment and investigations
- Charts rendered in PDF exports
- Deleted conversations and investigations kept for audit rather than erased
v3.2
- VulnCheck exploit intelligence: KEV status, exploit maturity (weaponized or proof of concept), CVSS v4, ransomware associations and ATT&CK technique mappings
- EPSS integration: 30-day exploit probability and percentile scores from FIRST
- Three-stage CVE enrichment: NVD, then VulnCheck, then EPSS, refreshed weekly
- CVE cards show VulnCheck KEV, Weaponized, PoC Available, Ransomware and EPSS badges
- High-profile CVEs detected automatically from KEV status and EPSS thresholds
- MCP server connected for external AI tools
v3.1
- AI agentic threat briefings: autonomous investigations across 7 entity types
- The investigating AI reads and cross-references the source articles itself
- Investigations cached for 72 hours, with PDF export
- Investigation findings fed back into campaigns, watch items, actor relationships and CVE-actor links
- MCP server for external AI tools, with 10 read-only tools
- Template escaping hardened
- Clearer errors when an investigation needs a login
v3.0
- AI article enrichment: threat actors, tools, breaches and alert signals
- Threat actor and attacker tool tracking with detail pages
- MITRE ATT&CK integration with technique mapping
- Vendor intelligence catalog
- Breach explorer with validation and merge tools
- Monthly and quarterly AI digests with PDF export
- Member accounts with invitation-based registration
- Member management: approve, suspend, revoke and assign roles
- Database backup, restore and optimisation tools
- Faster dashboard paging
- Breaking alerts and an article enrichment log
v2.2
- Administration panel with a central dashboard
- Caching and rate limiting to keep the service fast
- Usage monitoring with projections
v2.1
- AI daily digest
- PDF export for daily briefings
- Historical digest archive (90 days)
v2.0
- CVE tracking with NVD enrichment
- Trend analysis dashboard
- Industry vertical analysis
- Scheduled automation of feed collection and enrichment
v1.0
- Security news aggregator with filtering and search