Threat intelligence platform
Threat intelligence that is about you.
ThreatRaven analyzes the threat signals your team has no time to analyze, maps your organization's full profile, and alerts only where the two meet. Every alert carries its chain of evidence.
The gap
Two kinds of tools, and the question neither answers.
Which of today's threats concern the systems we actually run? Answering that takes an analyst who reads everything and knows the estate by heart. Most teams do not have one.
Everything, for everyone
Thousands of reports and indicators, the same for every subscriber. Deciding what matters to you is left to your team.
Exposure without context
A list of what you expose to the internet, with no word on who is attacking that kind of system this week.
The link between the two
Current threats matched to your organization's profile, with the intelligence, the relationship drawn from it and the asset shown side by side.
How it works
Three steps, running continuously.
Gather and analyze
Threat intelligence is collected, weighted for reliability, then analyzed. The relationships between threats and what they target are derived and verified.
- research and advisories
- security news
- vulnerability data
Know what you run
A scanner discovers what you expose to the internet. You declare what sits behind it: technology, infrastructure and the third parties you rely on.
- discovered by scan
- declared by you
- third parties
Alert where they meet
A threat against something you use, or one that matches your profile, becomes an alert, internet-facing or not. Exposure and exploitability decide how loud it is.
- one alert per story
- severity with reasons
- full evidence chain
Anatomy of an alert
Nothing to take on trust.
An alert is a claim, and a claim needs evidence. Each one carries the chain that produced it, so an analyst can check it in a minute.
- Why youThe asset or profile element that matched, and whether the scanner found it or you declared it.
- How we knowThe source intel, the relationship drawn from it, and the asset it landed on.
- How sureConfidence with its reasons: how many independent signals, how reliable, how certain the asset is.
Threat group targets IIS
raised 2h ago · intel 3h old
- 2 independent sources
- Product and version confirmed by the scanner
Who it is for
Security teams without a threat intelligence department.
- SOC and security teams that receive more intelligence than they can read.
- Organizations that must show they follow threats relevant to them, for example under the EU's DORA regulation.
- Managed security providers who must keep up with the threats relevant to many customers at once.
Design-partner pilots
Run it on your own perimeter.
- Length
- 60 to 90 days
- Scope
- Your external perimeter and the technology you declare
- Measured by
- Success criteria agreed before the start
See what it finds on your perimeter.
In Norse myth, Odin sent two ravens, Huginn and Muninn, across the world each day. They returned at dusk to tell him what they had seen.
ThreatRaven does the same for your organization: it watches everything, and brings back only what concerns you.
or write to contact@threatraven.com