Do you know your adversaries?

ISO 27001 (A.5.7), NIS2 and DORA require you to know your threat landscape. Our data set delivers it, and more: if you know your adversaries, you invest only where it counts.

Get in touch
Threat Profile · ExampleRelevance
01
QilinRansomware
94
02
AkiraRansomware
88
03
APT28Staatlich
82
04
SafepayRansomware
74
05
TheGentlemenRansomware
67

from 172 groups · weighted by industry, region, tech stack

Our Packages

From an individual threat profile to an action plan

Who is attacking, what do you protect first, and how do you detect the attack: three packages that build on each other answer the questions your security strategy really needs. Traceable, prioritized and directly actionable.

Who is targeting you?

Threat Profile

Relevant adversary groups for your industry, region and technology: not a generic list, but your specific risk picture.

  • Industry-specific threat actors
  • Regional threat landscape
  • Tech stack relevance
What to implement first?

Threat-Informed Roadmap

Top 20/50/100 attack techniques (TTPs) for your profile, with score-based prioritization and concrete measures.

  • MITRE ATT&CK mapping
  • Threat score per TTP
  • Prioritized measures
  • Mapping to ISO 27001:2022, NIST CSF and CIS Controls
  • Export for backlog/Jira
How do you detect attacks?

Detection Plan

Logging recommendations and detection strategies per TTP, so you know what you need to monitor.

  • Logging recommendations per TTP
  • Event sources for your SIEM
  • Detection strategies
Advisories

Current situation reports, free to share

When an actor becomes relevant for Germany, Austria and Switzerland, we publish the attack chain, TTP mapping and prioritized countermeasures. No form, no sign-up.

Threat Advisory
October 21, 2026
TLP:CLEAR · 12 pages

PHP2Shell: What the Critical PHP Vulnerabilities Mean for Your Organization

On October 21, 2026, the PHP project patched two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619, CVSS 9.2) that let adversaries execute code on any PHP web server without authentication. Germany's Federal Office for Information Security (BSI) rates the situation as Orange. Version 1.4 (October 23, 9:00 a.m.): attempts are widespread and automated, successful attacks are difficult and not yet confirmed; NCSC-NL is examining first signals, and the BSI knows of no compromise. New: the status for PAN-OS, Fortinet, Cisco, pfSense, OPNsense, QNAP and Synology, a corrected distribution table, and a regression in 8.4.27 and 8.5.12. Includes the attack flow as a graphic and the brief for IT on what to look for from October 17 onward.

VulnerabilityWeb ApplicationsPatch Management
Whitepaper
September 17, 2026
TLP:CLEAR · 10 pages

AI in the Cyber Kill Chain: Weapon or Target?

Where do adversaries actually use AI today, and where only in the lab? The whitepaper rates all 14 ATT&CK tactics by evidence and reach, drawing on the GTG-1002 campaign (MITRE C0062), the phishing field studies from Harvard and Berlin, and the first incident caused by an AI agent that was reported to the Spanish data protection authority (AEPD). The result: three zones, and two stages without any evidence from the field.

Artificial IntelligenceMITRE ATT&CKThreat-Informed Defense
Quick Check

Who is targeting you? Find out.

Three clicks, real threat data: choose industry, region and platforms, and see live which adversary groups are relevant to organizations like yours. Free, no sign-up.

Start the Quick Check ↗
THREAT INTEL172ADVERSARIES691TECHNIQUES1068MITIGATIONS93ISO CONTROLS