# Free Threat Intelligence Sources Worth Automating

> The free feeds that earn a place in a small team's pipeline — KEV, NVD, EPSS, vendor advisories and curated RSS — and how to combine them without drowning.

- Published: 2026-08-05T00:00:00.000Z
- Tags: Threat Intelligence, Automation
- Author: RuntimeRebel Editorial
- Canonical: https://runtimerebel.com/guides/free-threat-intelligence-sources

Threat intelligence has a paradox: the free tier is genuinely excellent, and
most teams still drown in it. The problem is rarely access — it is choosing
few enough sources that someone actually reads them. This guide is the short
list we would automate first, and the order.

## Tier 1: exploitation truth

**CISA KEV** is the anchor — the only major free feed whose every entry means
"confirmed exploited in the wild." It is small, machine-readable JSON, and
[explained in detail here](/guides/cisa-kev-catalog-explained). Automate the
*additions*: our [KEV changelog feed](/cve/new.xml) emits exactly that.

**FIRST EPSS** adds a daily exploitation-probability estimate per CVE — a
model rather than a fact, but a good tiebreaker for everything KEV has not
(yet) confirmed.

## Tier 2: the record of reference

**NVD** (the National Vulnerability Database) is where CVE metadata, CVSS
vectors and affected-product data live. It is comprehensive and therefore
unreadable as a feed — use it as a lookup API, not a subscription. The same
applies to MITRE's CVE list itself.

**Vendor advisories** for the products you actually run outrank everything
generic: Microsoft's Patch Tuesday notes, Cisco's security advisories, and
the equivalents for your firewall, VPN, hypervisor and backup vendors.
Subscribe narrowly — your stack, nothing else.

## Tier 3: curated reporting

Raw feeds tell you *that* something happened; reporting tells you whether it
matters. A small set of consistently reliable outlets — the investigative
blogs, the research teams that publish their own findings, the incident
trackers — beats a hundred aggregators repeating the same wire story. This
site's own [source roster](/about) is deliberately capped for that reason,
and weights primary research over high-volume newswires.

## Combining them without drowning

- **Route by severity, not by source.** One inbox for "exploited now" (KEV
  additions, critical-rated reporting), one digest for everything else. Our
  [per-severity RSS feeds](/api-docs) exist for exactly this split.
- **Deduplicate before humans see it.** The same CVE will arrive from five
  sources in one day; key alerts on the CVE ID.
- **Prefer structured over prose where a machine is the consumer.** For
  dashboards and enrichment, pull JSON — the KEV catalog directly, EPSS
  scores, or our [free threat-intel API](/api-docs), which serves the current
  threat level, severity mix and top CVEs with open CORS under CC BY 4.0.
- **Review the roster quarterly.** Feeds rot: sources go quiet, change scope
  or turn into marketing. A silent feed in your pipeline is worse than an
  absent one, because it looks like coverage.

## The one-line version

Automate KEV first, add EPSS as a tiebreaker, subscribe narrowly to your own
vendors, and keep the reading list short enough that it gets read.

---

Curated evergreen guide, produced with AI assistance and maintained by the site (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/guides/free-threat-intelligence-sources