Free Threat Intelligence Sources Worth Automating

Threat intelligence has a paradox: the free tier is genuinely excellent, and most teams still drown in it. The problem is rarely access — it is choosing few enough sources that someone actually reads them. This guide is the short list we would automate first, and the order.

Tier 1: exploitation truth

CISA KEV is the anchor — the only major free feed whose every entry means “confirmed exploited in the wild.” It is small, machine-readable JSON, and explained in detail here. Automate the additions: our KEV changelog feed emits exactly that.

FIRST EPSS adds a daily exploitation-probability estimate per CVE — a model rather than a fact, but a good tiebreaker for everything KEV has not (yet) confirmed.

Tier 2: the record of reference

NVD (the National Vulnerability Database) is where CVE metadata, CVSS vectors and affected-product data live. It is comprehensive and therefore unreadable as a feed — use it as a lookup API, not a subscription. The same applies to MITRE’s CVE list itself.

Vendor advisories for the products you actually run outrank everything generic: Microsoft’s Patch Tuesday notes, Cisco’s security advisories, and the equivalents for your firewall, VPN, hypervisor and backup vendors. Subscribe narrowly — your stack, nothing else.

Tier 3: curated reporting

Raw feeds tell you that something happened; reporting tells you whether it matters. A small set of consistently reliable outlets — the investigative blogs, the research teams that publish their own findings, the incident trackers — beats a hundred aggregators repeating the same wire story. This site’s own source roster is deliberately capped for that reason, and weights primary research over high-volume newswires.

Combining them without drowning

• Route by severity, not by source. One inbox for “exploited now” (KEV additions, critical-rated reporting), one digest for everything else. Our per-severity RSS feeds exist for exactly this split.
• Deduplicate before humans see it. The same CVE will arrive from five sources in one day; key alerts on the CVE ID.
• Prefer structured over prose where a machine is the consumer. For dashboards and enrichment, pull JSON — the KEV catalog directly, EPSS scores, or our free threat-intel API, which serves the current threat level, severity mix and top CVEs with open CORS under CC BY 4.0.
• Review the roster quarterly. Feeds rot: sources go quiet, change scope or turn into marketing. A silent feed in your pipeline is worse than an absent one, because it looks like coverage.

The one-line version

Automate KEV first, add EPSS as a tiebreaker, subscribe narrowly to your own vendors, and keep the reading list short enough that it gets read.