Vulnerability Threat Intelligence (VTI) involves proactively collecting, analyzing, and contextualizing information about vulnerabilities, their exploitability, and the threat actors actively using them. The goal is to prioritize and mitigate risks effectively. It moves beyond simply identifying weaknesses to understanding which vulnerabilities pose the most significant, most immediate danger to an organization based on the current threat landscape.
ThreatNG helps VTI, particularly focusing on the external attack surface. Here's how:
External Discovery
ThreatNG's ability to perform purely external unauthenticated discovery, without needing any connectors, is foundational for VTI. It identifies an organization's digital footprint as an attacker would see it, unearthing assets that might be forgotten or unknown internally but are exposed to the internet. This includes web applications, subdomains, cloud services, mobile apps, and code repositories. This initial discovery is crucial because an organization cannot gather vulnerability intelligence on assets it doesn't know exist.
Example of ThreatNG helping: ThreatNG might discover an old, forgotten public-facing staging server under a subdomain that the IT team was unaware of. This server could be running outdated software with known vulnerabilities, presenting an immediate attack vector that would otherwise go unnoticed.
External Assessment
ThreatNG's detailed external assessment capabilities directly feed into VTI by categorizing and scoring different types of external vulnerabilities and susceptibilities:
Web Application Hijack Susceptibility: ThreatNG analyzes external attack surface and digital risk intelligence, including Domain Intelligence, to identify potential entry points for attackers in web applications.
Example of ThreatNG helping: ThreatNG could identify an organization's primary web application using an outdated content management system (CMS) version with a known severe cross-site scripting (XSS) vulnerability. This finding directly informs VTI about a high-risk exploit path.
Subdomain Takeover Susceptibility: ThreatNG uses external attack surface and digital risk intelligence, incorporating Domain Intelligence, to evaluate the susceptibility of a website's subdomains to takeover, analyzing DNS records and SSL certificate statuses.
Example of ThreatNG helping: ThreatNG might detect a CNAME record for a subdomain pointing to a service that has been decommissioned, making it vulnerable to a subdomain takeover. An attacker could claim this service, hosting malicious content or phishing pages under the organization's legitimate subdomain.
BEC & Phishing Susceptibility: This is derived from Sentiment and Financials Findings, Domain Intelligence (including DNS and Email Intelligence), and Dark Web Presence (Compromised Credentials).
Example of ThreatNG helping: ThreatNG could find compromised employee credentials circulating on the dark web, indicating a heightened risk of Business Email Compromise (BEC) or successful phishing attacks against the organization's workforce.
Data Leak Susceptibility: This is derived from external attack surface and digital risk intelligence based on Cloud and SaaS Exposure, Dark Web Presence (Compromised Credentials), Domain Intelligence, and Sentiment and Financials.
Example of ThreatNG helping: ThreatNG identifies an open Amazon S3 bucket related to the organization's cloud infrastructure, exposing sensitive files. This direct exposure immediately flags a critical data leak vulnerability.
Cyber Risk Exposure: This score considers parameters covered by the Domain Intelligence module, such as certificates, subdomain headers, vulnerabilities, and sensitive ports. Code Secret Exposure and Cloud and SaaS Exposure are also factored in. The presence of compromised credentials on the dark web also increases this risk.
Example of ThreatNG helping: ThreatNG might discover a publicly exposed database port (e.g., MySQL or PostgreSQL) on an organization's server, alongside a critical vulnerability in the database software, significantly increasing the cyber risk exposure.
Breach & Ransomware Susceptibility: This assessment incorporates domain intelligence (exposed sensitive ports, private IPs, and known vulnerabilities), dark web presence (compromised credentials and ransomware events), and sentiment and financials.
Example of ThreatNG helping: ThreatNG could identify that an organization has exposed remote desktop (RDP) services with weak security and cross-reference this with its ransomware intelligence, indicating active ransomware gangs targeting RDP for initial access and signaling high ransomware susceptibility.
Mobile App Exposure: ThreatNG evaluates an organization’s mobile app exposure by discovering them in marketplaces and analyzing their contents for access credentials, security credentials, and platform-specific identifiers.
Example of ThreatNG helping: ThreatNG might discover an organization's mobile application in a third-party app store that contains hardcoded API keys or sensitive security credentials, providing a direct route for attackers to compromise backend systems.
Positive Security Indicators: Beyond vulnerabilities, ThreatNG identifies and highlights security strengths like Web Application Firewalls (WAFs) or multi-factor authentication, validating their effectiveness from an external attacker's perspective.
Example of ThreatNG helping: While identifying a vulnerability, ThreatNG might also detect the presence of a robust WAF, which, although not patching the underlying vulnerability, could mitigate its exploitability from the external perspective, providing crucial context for prioritization.
Reporting
ThreatNG provides various reports, including Executive, Technical, and, critically, Prioritized (High, Medium, Low, and Informational) reports. For VTI, these prioritized reports are invaluable. They translate complex vulnerability data into actionable insights, allowing security teams to focus resources on the most critical external risks first, rather than being overwhelmed by a long list of findings.
Example of ThreatNG helping: Instead of a generic list of 50 vulnerabilities, ThreatNG's prioritized report would highlight the top 3-5 external vulnerabilities that have active exploits (from KEV) and are on critical internet-facing assets, enabling the security team to allocate resources immediately to address these high-impact threats.
Continuous Monitoring
ThreatNG continuously monitors all organizations' external attack surfaces, digital risks, and security ratings, ensuring that VTI remains current. As new vulnerabilities are disclosed, exploits become public, or an organization's external footprint changes, ThreatNG rapidly updates its assessments, providing real-time threat intelligence.
Example of ThreatNG helping: A new zero-day vulnerability might be publicly disclosed in a widely used web server. ThreatNG's continuous monitoring would quickly identify if any of the organization's external web servers are running the vulnerable version, immediately flagging it as a critical new vulnerability requiring urgent attention, often before traditional internal scanning tools catch up.
Investigation Modules
ThreatNG's detailed investigation modules provide the depth necessary to understand the nuances of external vulnerabilities and their associated threats:
Domain Intelligence: This includes Domain Overview, DNS Intelligence, Email Intelligence, WHOIS Intelligence, and Subdomain Intelligence.
Example of ThreatNG helping: ThreatNG might uncover misconfigured DNS records pointing to a defunct server through DNS Intelligence, creating a potential subdomain takeover vulnerability. Subdomain Intelligence further identifies exposed administrative pages on newly discovered subdomains that lack proper authentication, posing a direct attack vector.
Sensitive Code Exposure: This module discovers public code repositories and investigates their contents for sensitive data, including access credentials, security credentials, configuration files, etc.
An example of ThreatNG helping: ThreatNG identifies a public GitHub repository maintained by an employee that inadvertently contains hardcoded API keys for a critical internal service. Attackers could use this severe code secret exposure to gain unauthorized access.
Search Engine Exploitation: This involves discovering website control files like
robots.txtandsecurity.txtand assessing susceptibility to exposing sensitive information via search engines.Example of ThreatNG helping: ThreatNG might find that an organization's
robots.txtfile is improperly configured, inadvertently allowing search engines to index sensitive internal directories like/adminor/dev, effectively exposing them to attackers.
Cloud and SaaS Exposure: Identifies sanctioned and unsanctioned cloud services, impersonations, and open exposed cloud buckets across major providers and various SaaS implementations.
Example of ThreatNG helping: ThreatNG detects an unsanctioned Google Cloud Platform bucket associated with the organization configured for public read access, inadvertently exposing internal project documents to the Internet.
Online Sharing Exposure: Detects organizational entity presence within online code-sharing platforms like Pastebin or GitHub Gist.
Example of ThreatNG helping: ThreatNG discovers an organization's internal network diagrams or confidential customer lists posted on Pastebin by a disgruntled employee or a compromised account, indicating a significant data leak.
Dark Web Presence: Monitors organizational mentions of related or defined people, places, or things, associated ransomware events, and compromised credentials.
Example of ThreatNG helping: ThreatNG identifies discussions on a dark web forum about a new exploit targeting a specific technology stack the organization uses. This intelligence helps the organization preemptively patch or mitigate the vulnerability before it's actively targeted.
Intelligence Repositories (DarCache)
ThreatNG's DarCache repositories are central to its VTI capabilities, providing crucial context:
DarCache Dark Web & DarCache Rupture (Compromised Credentials): These provide real-time intelligence on leaked credentials and underground discussions, directly informing VTI's "active threat" component.
Example of ThreatNG helping: ThreatNG identifies thousands of compromised employee credentials linked to the organization in DarCache Rupture, signaling an immediate need for password resets and MFA enforcement to prevent account takeovers.
DarCache Ransomware: Tracks over 70 ransomware gangs, providing insights into their TTPs and targeted vulnerabilities.
Example of ThreatNG helping: If DarCache Ransomware indicates that a particular gang is actively exploiting a newly discovered vulnerability in a specific VPN solution, and ThreatNG's external discovery finds that the organization uses that VPN, it creates a high-priority VTI alert.
DarCache Vulnerability: This is the core VTI repository, comprising:
DarCache NVD: Provides detailed technical characteristics and impact scores (CVSS, severity) of vulnerabilities.
DarCache EPSS: Offers a probabilistic estimate of the likelihood of a vulnerability being exploited shortly, allowing for forward-looking prioritization.
DarCache KEV (Known Exploited Vulnerabilities): Flags vulnerabilities actively being exploited in the wild, providing critical context for immediate remediation.
DarCache eXploit (Verified Proof-of-Concept Exploits): Provides direct links to PoC exploits, accelerating understanding how a vulnerability can be exploited and aiding in assessment and mitigation strategy development.
Example of ThreatNG helping: ThreatNG might identify a vulnerability in an organization's exposed web server. Referencing the DarCache Vulnerability, it learns that while the NVD score is high, the EPSS is relatively low. Critically, it's listed in KEV with a linked PoC exploit. This combination prioritizes the vulnerability as extremely urgent, as it's not just severe but actively being exploited with available tools.
Complementary Solutions
ThreatNG's external VTI capabilities can work synergistically with other cybersecurity solutions to create a more robust defense posture:
Security Information and Event Management (SIEM) Systems: ThreatNG can feed its prioritized external vulnerability intelligence directly into SIEMs. This allows for correlation of external threats with internal security events and logs.
Example of ThreatNG and complementary solutions working together: ThreatNG detects a new, actively exploited vulnerability (from DarCache KEV) on an organization's internet-facing VPN gateway. This intelligence is sent to the SIEM, which monitors internal network logs for any unusual connection attempts or lateral movement originating from the VPN, enabling faster detection of a potential breach.
Vulnerability Management Platforms (VMPs): While ThreatNG focuses on external context, VMPs typically manage internal scanning and remediation workflows. ThreatNG's VTI (especially EPSS and KEV data) can enrich the prioritization within VMPs.
Example of ThreatNG and complementary solutions working together: A VMP identifies numerous internal vulnerabilities. ThreatNG's VTI data can be integrated to highlight which of these internal vulnerabilities are also publicly known, actively exploited, or have available PoC exploits, allowing the VMP to prioritize patching efforts for the most critical internal flaws that could be exploited externally.
Endpoint Detection and Response (EDR) / Extended Detection and Response (XDR) Solutions: ThreatNG's insights into known exploited vulnerabilities, threat actor TTPs (from Dark Web and Ransomware intelligence), and code secret exposures can enhance EDR/XDR detection rules and threat hunting.
Example of ThreatNG and complementary solutions working together: ThreatNG discovers that an organization's public-facing web server has a vulnerability for which a specific ransomware gang (identified in DarCache Ransomware) is known to exploit. This intelligence can be pushed to the EDR system, which then looks explicitly for behaviors or indicators of compromise associated with that ransomware gang on the affected server, allowing for earlier detection and prevention of a ransomware attack.
Threat Intelligence Platforms (TIPs): ThreatNG's rich DarCache intelligence, particularly on vulnerabilities, dark web activity, and ransomware, can augment a central TIP.
Example of ThreatNG and complementary solutions working together: A central TIP aggregates various threat feeds. ThreatNG can contribute highly specific, validated PoC exploit links and detailed KEV data to the TIP, providing a more granular and actionable view of external threats than generic feeds alone.
By providing deep, real-time, and contextualized intelligence on external vulnerabilities, ThreatNG directly supports VTI, empowering organizations to make intelligent, more proactive security decisions and effectively protect their digital assets from the outside in.
