Predictive threat intelligence for SMBs and MSSPs

See threats rising before they reach you.

CTI Forecast continuously reads 338 research sources (vendors, CERTs, labs). It extracts hashes, IPs, domains and CVEs, removes the noise, links every indicator to the article that cites it and flags the ones whose mentions are accelerating. From €49 per month.

Try Pro free for 14 days, no card Read this week's bulletin
Latest additionsconfidence
  1. sha2569e39de2881273acc225a149c72ba3e0f51424963669ab633ee1dc7df5db067b470
  2. ip138[.]199[.]47[.]18473
  3. cveCVE-2026-12395883
  4. domaintacking-uspst-sl[.]com70
  5. sha2560164d7ceae5bb909c272af151ff44b1177ae9b47d9424b94f1d9558c30934d1970
  6. ip91[.]132[.]138[.]21373
  7. cveCVE-2026-1740283
  8. domainuspskc[.]com76
Measured on historical data, 7 August 2026 to 7 November 2026
63%of exploited vulnerabilities (CISA KEV) were already tracked before being added
17 daysmedian lead time over CISA
0.81forecast model AUC, versus 0.58 for EPSS alone

Method, comparisons and limitations: model performance.

Preview · real API responses, today's data

What you actually get

GET /v1/lookup?value=…enriched IP
{
  "value": "45[.]148[.]10[.]212",
  "found": true,
  "matches": [
    {
      "value": "45[.]148[.]10[.]212",
      "type": "ip",
      "confidence": 100,
      "confidence_base": 100,
      "first_seen": "2026-08-07T15:19:00.362575",
      "last_seen": "2026-11-08T00:15:07.663622",
      "source": "www.paloaltonetworks.com",
      "malware_family": null,
      "asn": 48090,
      "as_name": "DMZHOST TECHOFF SRV LIMITED",
      "country": "GB",
      "references": [
        {
          "url": "https://www.aquasec.com/blog/trivy-supply-chain-attack-what-…",
          "source": "www.aquasec.com",
          "seen_at": "2026-09-24T13:19:43.690311"
        }
      ]
    }
  ]
}
GET /v1/forecast?signal=imminenteCVE forecast
{
  "horizon_days": 30,
  "count": 1,
  "data": [
    {
      "cve": "CVE-2024-3094",
      "signal": "imminente",
      "signal_label": "Likely exploitation soon",
      "forecast_score": 100,
      "epss": 0.909,
      "in_kev": false,
      "mentions_7d": 49,
      "mentions_previous_7d": 51,
      "reasons": [
        "Facteur : probabilité EPSS",
        "Facteur : volume de mentions sur 7 jours",
        "Facteur : mentions la semaine précédente",
        "EPSS : 90.9% (rang 100%)",
        "49 mentions sur 7 jours, 51 la semaine d'avant"
      ]
    }
  ]
}

The same data is available as STIX 2.1, over TAXII 2.1 and as blocklists. Free-text fields such as reasons are currently in French. API documentation.

Feed volume · updated 8 November 2026 at 00:20 UTC
1,242,511candidates analysed since launch
338research sources tracked
259,074indicators published
99,990CVEs
59,217SHA-256
50,641SHA-1
32,787MD5
3,891Domains
12,356IP addresses

Why not a free feed?

Every indicator comes with context

You see which article published the IP or hash, by whom and when. Analysts know straight away why an alert fires, without digging.

The noise is removed before it reaches you

Articles cite thousands of legitimate sites. Out of 1.2 million candidates, fewer than one in five passes the filter. See the numbers.

Connected in 5 minutes

TAXII 2.1 for OpenCTI, Sentinel and MISP, blocklists for pfSense, OPNsense and Wazuh, a JSON API for everything else. Integration guides.

A forecast, not just a list

For each CVE, CTI Forecast estimates the probability of confirmed exploitation within 30 days by combining EPSS with mention dynamics across security research, and explains the score. The model is retrained weekly and its results are published: /v1/forecast.

Pricing

Free

TLP:CLEAR
€0 / month excl. VAT
  • 100 requests per day
  • CVEs and SHA-256 only
  • Data delayed by 24 h
  • SHA-256 blocklist
  • Top 10 trends
Create account

Pro

TLP:GREEN
€49 / month excl. VAT
  • 10,000 requests per day
  • All indicator types
  • Real time (synced every 5 min)
  • TAXII 2.1 server, STIX 2.1 export, blocklists
  • Source articles for every indicator
  • Full trends (accelerating threats)
Try free for 14 days

Business

TLP:AMBER
€199 / month excl. VAT
  • 100,000 requests per day
  • All indicator types
  • Real time (synced every 5 min)
  • TAXII 2.1 server, STIX 2.1 export, blocklists
  • Source articles for every indicator
  • Full trends (accelerating threats)
  • Bulk CSV / JSON export (500,000 rows)
Get started

The Pro trial requires no credit card. If no card is added by the end of the 14 days, the account simply returns to Free. Prices in euros; billed by CTI Forecast (France).

MSSP, high volumes or invoiced billing? Tailored offer, extended trial, DPA and purchase orders. Free sampleContact us