THREAT INTELLIGENCE SOURCES
Balbix leverages a wide range of threat intelligence via near real-time automation, including commercial, government, open source and proprietary feeds, in order to ensure that risk-based prioritization of exposures and risk quantification takes the current global threat landscape into account.
The following is a representative, though not exhaustive, list of key intelligence providers and resources that inform our analysis and response strategies.
Source | Link | Description |
|---|---|---|
NVD | The National Vulnerability Database (NVD) is the U.S. government's authoritative resource for managing and disseminating information about software vulnerabilities. Maintained by NIST, the NVD leverages the Security Content Automation Protocol (SCAP) to provide standardized data on security flaws, configuration checklists, and impact metrics. This supports automated vulnerability management, compliance, and security measurement across diverse IT environments. In addition to cataloging security weaknesses (like CVEs), the NVD offers tools such as CVSS calculators and CPE dictionaries to assess risk and streamline security workflows. | |
CISA KEV | https://www.cisa.gov/known-exploited-vulnerabilities-catalog | The Known Exploited Vulnerabilities (KEV) Catalog, maintained by CISA, is a public repository of vulnerabilities that are actively being exploited in the wild. It is designed to help organizations prioritize remediation efforts by highlighting high-risk vulnerabilities that present a significant threat to systems and networks. The catalog supports federal agencies in complying with Binding Operational Directive (BOD) 22-01, but is also widely used by the private sector to bolster their vulnerability management and incident response programs. |
VulDB | VulDB is a comprehensive vulnerability management and threat intelligence platform. It offers real-time updates on newly discovered vulnerabilities, threat actor activities, exploit markets, and detailed risk assessments. The platform integrates vulnerability data with cyber threat intelligence (CTI) to help organizations anticipate potential attacks and strengthen their security posture. VulDB also includes tools such as CVSS scoring, exploit pricing estimations, and detailed vulnerability entries. | |
CWE | The Common Weakness Enumeration (CWE) is a community-driven initiative maintained by MITRE that categorizes and describes software and hardware weaknesses that can lead to vulnerabilities. It provides a standardized language and taxonomy for security flaws, helping organizations identify, mitigate, and prevent common coding and design errors. The project is widely used in secure software development, risk assessment, and compliance frameworks. | |
Exploit-DB | Exploit Database (Exploit-DB) is a curated archive of publicly disclosed exploits and proof-of-concept (PoC) code, widely used by penetration testers, security researchers, and ethical hackers. Managed by Offensive Security, it provides practical examples of how vulnerabilities can be exploited across various platforms and software. It also includes shellcode, research papers, and integration with tools like SearchSploit for offline use. | |
EPSS | The Exploit Prediction Scoring System (EPSS), developed by FIRST, is a data-driven framework designed to estimate the likelihood of a software vulnerability being exploited in the wild. By combining CVE metadata with threat intelligence and other contextual factors, EPSS provides a probability score to help organizations prioritize remediation efforts. Unlike CVSS, which focuses on severity, EPSS offers insight into exploit likelihood, supporting more risk-based vulnerability management. | |
OWASP Top 10 | The OWASP Top Ten is a globally recognized resource that highlights the most critical security risks facing web applications. Maintained by the Open Web Application Security Project, it serves as a foundational guide for developers, security professionals, and organizations seeking to improve application security practices. The list is based on community input, industry data, and real-world incidents, making it a key reference point for secure coding, risk management, and compliance initiatives. | |
Microsoft MAPP program | The Microsoft Active Protections Program (MAPP) is a collaboration between Microsoft and trusted security partners to share advance vulnerability information. The goal is to enable partners to deploy protections ahead of public disclosure, reducing customer risk. |