Threat Intelligence

Enrich and triage Atlassian security releases in the Vulnerability Intel Agent

Filter CVEs by attack path, products, or patch policy

Andrew Castro

on Aug 06, 2026

BLUF

The Vulnerability Intel Agent now ingests each Atlassian security release within minutes of publication and continuously enriches every CVE with CVSS, EPSS, attack-path details, patch availability, and exploitation signals like proof-of-concept activity and CISA KEV as they emerge.

You can filter the release by attack path, the products you run, or your patch criteria to focus on the CVEs that require action.

Challenge

The number of CVEs disclosed in security releases is rising as vendors and researchers increasingly use AI to uncover vulnerabilities, while the time between disclosure and exploitation continues to shrink.

For a team running just a handful of Atlassian products, quickly identifying which CVEs actually matter from a recent security release, and then manually validating each against severity, attack path, and internal patching policies, becomes increasingly difficult as the list grows.

How does it work?

• Add the filter. In the Vulnerability Intel Agent, select the Atlassian security release you want, or "Latest Atlassian Security Release," which always points at the most recent one, and set the date range. Every CVE from the release appears in the output table. Atlassian is one of several vendor advisories available.
• Columns. Each enrichment field is a column, alongside the CVE ID and a plain description of the vulnerability. Reorder, show, or hide them to match how you triage.
• Alerts. Deploy the Intel Agent and get notified when new CVEs match your filters.

Filter to your stack

Filter the release at the product level, down to the Atlassian products you actually run.

The July 21st release includes 3 CVEs affecting Confluence Data Center, Sourcetree, and Jira. You can focus on the systems in your environment and prioritize your patch or remediation accordingly.

Filter by attack path

Add filters for attack vector, privileges required, and user interaction.

The July 21st, 2026 release includes 28 CVEs that can be reached by an attacker without credentials or any user interaction.

Filter by your patch policy

Most patch-now policies come down to a threshold: CVSS above a certain score, EPSS above a certain probability, or both. Set those thresholds as filters.

The July 21st release includes 17 CVEs at CVSS 8 and above with EPSS above 80%. You can remediate them immediately under your SLA and leave the rest for the normal patch cycle.

Filter CVEs by attack path, products, or patch policy

Curious to see how Feedly Threat Intelligence can help you collect and prioritize Apple vulnerabilities faster?

Start Free Trial

FAQs

Threat Intelligence

Enrich and triage Apple security releases in the Vulnerability Intel Agent

Filter CVEs by exploitation, products, or patch policy

Andrew Castro

on Jul 21, 2026

BLUF

The Vulnerability Intel Agent now ingests each Apple security release within minutes of publication. Each CVE is continuously enriched with exploitation status, proof-of-concept activity, CISA KEV, CVSS, EPSS, and patch availability.

You can filter the release by exploitation activity, the products you run, or your patch policy thresholds to focus on the CVEs that require action.

How does it work?

• Add the filter. In the Vulnerability Intel Agent, select the Apple security release you want, or "Latest Apple Security Release," which always points at the most recent one, and set the date range. Every CVE from the release appears in the output table. Apple is one of several vendor advisories available.
• Columns. Each enrichment field is a column, alongside the CVE ID and a plain description of the vulnerability. Reorder, show, or hide them to match how you triage.
• Alerts. Deploy the Intel Agent and get notified when new CVEs match your filters.

Filter by exploitation

Add filters for exploited, proof of concept, weaponized (exploited as part of a malware chain), or listed on the CISA KEV.

The June 29, 2026 release includes two CVEs with PoCs published June 30 and July 1. You can prioritize patching them and check your logs for exploitation attempts.

Filter to your stack

Filter the release at the product level, down to the Apple products you actually run.

The June 29 release includes 37 CVEs affecting macOS. You can focus on the systems you have to patch and skip the iOS and iPadOS entries that do not apply.

Filter by your patch policy

Most patch-now policies come down to a threshold: CVSS above a certain score, EPSS above a certain probability, or both. Set those thresholds as filters.

The June 29 release includes three CVEs at CVSS 8 and above with EPSS above 80%. You can remediate them immediately under your SLA and leave the rest for the normal cycle.

Curious to see how Feedly Threat Intelligence can help you collect and prioritize Apple vulnerabilities faster?

Filter CVEs by exploitation, products, or patch policy.

Try the Vulnerability Intel Agent

Threat Intelligence

Triage indicators faster with VirusTotal verdicts in Feedly

Feedly now pulls VirusTotal enrichment into your IoC Insights Cards.

Alessandro Magi

on Jul 07, 2026

15-second summary

Triaging indicators of compromise (IoCs) often means reviewing the IoC list associated with a threat actor and deciding whether any of them are malicious enough to act on. That typically means manually compiling VirusTotal data with data surfaced by Feedly's Threat Context Engine to get the full picture.

You can now bring your VirusTotal license to Feedly to see VirusTotal detection data inside IoC Insights Cards. That means you can:

• Confirm if malicious in seconds with VirusTotal verdicts embedded in IoC Insights Cards.
• Judge zero-detection domains from WHOIS, certs, and hosting.
• Continue your investigation on VirusTotal in one click.

From research to validation, in one view.

Validating indicators can require context-switching back to VirusTotal

Feedly already gives you the threat context behind an indicator. But to determine whether it's actively malicious, you still have to look it up in VirusTotal separately, then manually reconcile the two. Do that across dozens of IoCs, and you've spent the afternoon moving between tools, assembling what should already be in one place.

Confirm if malicious in seconds with VirusTotal verdicts embedded in IoC Insights Cards

By bringing your VirusTotal license into Feedly, everything tied to an indicator, including malware families, threat actors, and campaigns, plus VirusTotal's verdicts and reputation scores, can live on the same IOC Insights Card.

IoC Insights Card showing VirusTotal verdicts.

Judge zero-detection domains from WHOIS, certs, and hosting

You'll also find WHOIS records, certificate data, network attribution, and community votes on the IoC Insights Card. Say you're checking a domain tied to ShinyHunters' latest infrastructure; it's all there, so you can go deeper without leaving the card.

IoC Insights Card showing WHOIS records, certificate data, network attribution, and community votes on the IoC Insights Card.

Continue your investigation on VirusTotal in one click

If you want to check VirusTotal's full dataset yourself, one click opens the indicator directly in VirusTotal from the IoC Insights Card. It's also how your team can trace the enrichment back to its source, so you can stand behind the context when needed.

Opening VirusTotal straight from an IoC Insights Card.

Set it up in minutes with the VirusTotal license you already have

Connecting VirusTotal doesn't require professional services or backend configuration. Paste your existing VirusTotal API key into your account settings, and the enrichment appears across your IoC Insights Cards from that point on.

Setting up VirusTotal.

Your VirusTotal data stays yours

The VirusTotal data you bring into Feedly belongs to you, not to the platform. It's visible only to your account, never stored by Feedly, and never shared with other users, including others in your own organization.

Start your free trial

Feedly helps CTI teams discover emerging threats, contextualize what matters, and deliver tailored intelligence in minutes. The VirusTotal integration brings detection verdicts and reputation alongside your OSINT, so you can confirm what's malicious and deliver it ready to act on.

Try Feedly Threat Intelligence

Threat Intelligence

Feedly achieves SOC 2 Type 2

Independently audited by A-LIGN under the AICPA's SOC 2 framework

Gaby Zedan

on Jul 02, 2026

15-Second summary

After completing System and Organization Controls (SOC) 2 Type 1, Feedly has completed its SOC 2 Type 2 examination verified by A-LIGN. The audit confirms that Feedly's controls for Security, Availability, and Confidentiality operated effectively throughout the examination period. For CTI teams and security organizations trusting Feedly with their intelligence workflows, this is the formal, audited proof that those controls work.

Overview

Security teams trust Feedly with their most sensitive work like tracking threat actors, monitoring vulnerabilities, and surfacing intelligence that informs real organizational decisions. That trust has always driven how we build and operate. SOC 2 Type 2 makes it auditable.

What is SOC 2 Type 2?

SOC 2 is an examination framework established by the American Institute of Certified Public Accountants (AICPA). It evaluates whether a company's systems and controls reliably protect customer data across five trust service categories: security, availability, processing integrity, confidentiality, and privacy.

Type 2 is the harder bar. A Type 1 audit confirms that controls exist at a single point in time. Type 2 confirms that those controls operated effectively over an extended period. In our case, we were already Type 1 verified and are now verified for Type 2 by A-LIGN, the leading cybersecurity compliance auditor trusted by more than 4,000 global organizations.

What our audit covered

Our SOC 2 Type 2 report covers three trust service categories for the Feedly system:

• Security: protecting the system against unauthorized access, both physical and logical
• Availability: ensuring the system is available for operation and use as committed
• Confidentiality: protecting information designated as confidential

The examination period ran from January 1, 2026 to March 31, 2026, and the report was issued on April 20, 2026.

Why this matters for CTI teams

The organizations using Feedly Threat Intelligence are often in industries where data security is a requirement. Financial institutions, government contractors, healthcare organizations, and critical infrastructure teams operate under strict compliance mandates. Their procurement and legal teams need documented proof that the tools in their environment meet the bar.

SOC 2 Type 2 gives your security and compliance teams something concrete: an independent, audited report that documents exactly how Feedly protects your data. It removes a friction point from the procurement process and gives internal champions a clear answer when IT or InfoSec asks "how do we know Feedly is secure?"

Security has been foundational to how we build Feedly from the start. SOC 2 Type 2 is the formal verification of that commitment, not just for our current customers, but for every security team evaluating whether Feedly belongs in their stack.

Olivier Devaux, Co Founder of Feedly

What comes next

SOC 2 Type 2 is an ongoing commitment. It requires annual re-examination, which means our controls are continuously monitored. As Feedly grows with new integrations, new AI capabilities, new enterprise customers, SOC 2 gives us a structured way to make sure security keeps pace with every change we ship.

Access the report

If you're a Feedly customer and need a copy of our SOC 2 Type 2 report for your security review or procurement process, reach out to your Account Executive to download the full report.

If you're evaluating Feedly for your organization and want to know more about our security posture and features, contact our team here: sales@feedly.com

Try Feedly Threat Intelligence

Go from signals to tailored intelligence in minutes.

Get Started for Free

FAQs

Threat Intelligence

Keep your OpenCTI knowledge graph current, automatically

Every report collected in your Feedly AI Feeds automatically becomes a finished STIX 2.1 bundle, pushed into your OpenCTI

Shawn Jaques

on May 28, 2026

The 15-second version

OpenCTI gives your team one connected knowledge graph for threat intelligence. But it does not collect anything on its own. So analysts read reports, copy out entities, and reshape data into STIX by hand, and collection quietly eats the hours that should go to analysis.

Feedly Threat Intelligence now feeds your OpenCTI graph directly, turning 5,000 open sources into finished, relationship-rich STIX 2.1. From one connector you can:

• Track what matters. Collect intelligence scoped to the actors, malware, and CVEs your team actually follows.
• Get it structured. Every entity arrives with its threat actors, TTPs, malware, CVEs, and IoCs, and the relationships between them already mapped.
• No manual import. Reports flow into OpenCTI automatically as native STIX 2.1 bundles, straight from your AI Feeds.

From open source to extracted entities to a STIX-native knowledge graph, without the manual collection and tagging in between.

Every report becomes a finished STIX 2.1 bundle, pushed into OpenCTI.

Here is a guided tour of how the integration works.

A knowledge graph is only as good as what flows into it

OpenCTI gives CTI teams a powerful foundation for organizing, correlating, and operationalizing threat intelligence. But the platform does not collect intelligence on its own. To get value from it, teams need a reliable way to feed it high-quality, relevant data, consistently and at scale.

Most teams lean on IoC-heavy commercial feeds that deliver volume without narrative context, so threat-actor profiles stay thin and TTP coverage stays patchy. Analysts make up the difference by hand: reading blogs, pulling reports, copying entities into the platform. Collection consumes hours that should go to analysis.

The result is a team spending more time managing data to feed the graph than analyzing it.

Feedly Threat Intelligence automates the collection, structuring, and filtering. It monitors 5,000 open sources and uses analyst-led AI to extract, structure, and deliver open-source intelligence (OSINT) straight into OpenCTI, so your knowledge graph reflects the current threat landscape without your analysts building it by hand.

Track the threats you care about across 5,000 open sources

Most of those 5,000 sources are noise for any given team. Feedly AI Feeds solve the signal-to-noise problem before anything reaches OpenCTI.

AI Feeds are continuously updated streams filtered to your threat profile: the actors targeting your sector, the malware families relevant to your stack, the vulnerabilities that matter to your infrastructure. You can also pull exclusively from sources your team already trusts, specific vendor advisories, or government feeds, so the graph reflects provenance your analysts stand behind.

Scope a feed to what you track, and the connector pulls from it continuously. When a new Lazarus implant like RemotePE is first reported, it surfaces in the feed already tagged with its IoCs and TTPs, instead of waiting for an analyst to stumble on it.

AI Feed researching threats in the finance industry surfaced in threat intelligence reports.

Entities extracted, TTPs mapped to ATT&CK, relationships drawn

Feedly AI Models read each report and identify the entities inside it: IoCs (IPs, domains, hashes, URLs, email addresses, file paths, and registry keys), CVEs, malware families, threat actors, and TTPs.

The Threat Graph then maps the relationships between them: which actor uses which malware, which CVE is exploited in which campaign, which TTPs map to which ATT&CK techniques. Those links come from the source reporting itself, so the analytical context that makes intelligence meaningful is preserved, not stripped away.

For the RemotePE report, that means Lazarus, the malware, the delivery technique, and the ATT&CK TTPs arrive already connected. By the time intelligence leaves Feedly, it is no longer unstructured text. It is a set of connected entities ready to enrich your graph.

Every report becomes a finished STIX 2.1 bundle in OpenCTI

OpenCTI is built natively on STIX 2.1. So is Feedly's output.

Every report the connector delivers arrives as a STIX 2.1 bundle: threat actors, malware, TTPs, indicators, and vulnerabilities expressed as proper STIX objects, with the relationships between them intact. They map directly to OpenCTI's data model, with no transformation or cleanup on your end.

Open the RemotePE report in OpenCTI and it is already a connected graph: the report linked to Lazarus, to related malware like POOLRAT and ThemeForestRAT, and to the ATT&CK techniques it uses. Correctly typed, correctly linked, ready for analysts to pivot on.

OpenCTI report view showing a Feedly-sourced report with extracted TTPs, threat actor associations, and IoCs visible in the Associations panel.

Pivot from any entity back to the original report

Structured intelligence is only trustworthy if you can check it. Every entity Feedly delivers stays linked to the report it came from.

Connect Feedly to OpenCTI in about 15 minutes

Connecting Feedly to OpenCTI takes about 15 minutes. You will need a Feedly Threat Intelligence subscription with API access, OpenCTI 6.x or later, and a standard connector environment.

• Deploy the connector from the OpenCTI connectors repository.
• Add your credentials, your Feedly API token and OpenCTI URL.
• Choose your AI Feeds and Folders, which decides what flows in.
• Set the ingestion interval, hourly is a common starting point.
• Verify in the OpenCTI Data > Ingestion panel.

Full configuration steps are in the Feedly + OpenCTI integration documentation.

You decide what enters your knowledge graph

Feedly does not push everything it finds. You choose which AI Feeds and sources the connector pulls from, and you tune that scope as your requirements change. The graph stays a reflection of your priorities, shaped and verified by your analysts.

Put your OpenCTI to work

Feedly helps CTI teams discover emerging threats, contextualize what matters, and deliver tailored intelligence in minutes. This integration pushes that intelligence into your OpenCTI.

See it run with your own OpenCTI instance.

Start free trial

Threat Intelligence

Feedly Best Practices for CTI Teams

Optimize your team's workflows with Feedly for Threat Intelligence

Shawn Jaques

on May 19, 2026

How do Cyber Threat Intel (CTI) teams collaborate within Feedly to increase productivity and reduce blind spots? In this post, we’ll share best practices we’ve observed working with CTI teams across industries and how they’re using Feedly’s newest capabilities to move faster at every stage of the intelligence cycle.

Motivated? Read on.

Collecting relevant intelligence

The volume of cybersecurity articles, reports, blogs, and posts on the open web can seem overwhelming. How do you identify what’s important, focus on the intelligence needs of the business, and avoid wasting time on irrelevant or duplicate information?

Feedly’s Intel Agents (Vulnerability, Cyberattack, and TTP) replace that manual effort with continuous, filtered monitoring across 10,000+ OSINT sources, so your team starts each day already caught up.

Vulnerability Intel Agent

Personalized to your tech stack, the Vulnerability Intel Agent surfaces high-risk CVEs with the context needed to prioritize fast: CVSS and EPSS scores, active exploit indicators, PoC availability, and linked threat actors. Filter by vendor, product, attack vector, and more to cut noise and focus on what actually matters to your environment.

Cyberattack Intel Agent

The Cyberattack Intel Agent monitors attack activity targeting your industry in real time, pulling from 10,000+ sources including SEC filings and regional stock exchanges. Filter by attack type, industry, actors, and malware to zero in on incidents that are relevant and use the “What? So what?” column to triage without opening every article.

TTP Intel Agent

The TTP Intel Agent tracks trending ATT&CK techniques and extracts procedures so you can prioritize threat hunts without hours of manual tagging. Filter by industry, threat actor, or malware family, track behavioral shifts over customizable date ranges, and launch directly into MITRE ATT&CK Navigator to build attack emulations grounded in current adversary behavior.

AI Feeds

AI Feeds remain the backbone of ongoing collection. Powered by 1,000+ AI Models, they continuously scan millions of sources and surface articles aligned to your PIRs with higher relevance and lower noise than keyword searches. Most teams organize AI Feeds into Team Folders by intelligence requirement or stakeholder group, and treat them as the always-on layer underneath their Agents.

Triage and analyze emerging threats

Collecting the right signals is only half the job. Feedly’s Insights Cards and Ask AI help teams get from raw article to finished analysis faster, without switching tools or synthesizing dozens of reports by hand.

Insights Cards

Insights Cards give you structured, continuously updated context on any threat (CVE, Cyberattack, Threat Actor, or IoC) aggregated from thousands of sources into a single view. Instead of piecing together context across tabs, you get the full picture in one place: timelines, TTPs, malware, attribution, severity scores, and source citations. Vulnerability teams use CVE Insights Cards to jumpstart triage; incident responders lean on Cyberattack Cards to quickly assess exposure; threat hunters use Threat Actor Cards to prepare hunts and tabletop exercises.

Ask AI

Ask AI can be ran on top of your Intel Agents and Insights Cards as well as AI Feeds so analysts can synthesize intelligence across multiple languages, extract IoCs, TTPs, and CVEs, and produce finished deliverables all without leaving Feedly. Every response is grounded in the Real-Time Threat Graph and cited back to its original sources, so analysts stay in control of what goes into the final product. Teams use it to draft vulnerability briefs, flash reports, threat actor profiles, and executive summaries in minutes rather than hours.

Produce intelligence

Collecting and analyzing threats is only part of a CTI analyst's job. The other part is producing the reports and briefs that keep your team and stakeholders informed. Whether it's a daily threat brief, a weekly vulnerability digest, or an executive summary after a major incident, Feedly's Report Builder and Automated Newsletters help you produce consistent, high-quality intelligence outputs without the hours of manual work.

Report Builder

Creating a threat intelligence report manually can take anywhere from 3 to 8 hours. The Report Builder brings that down to minutes. Start from a Feedly template or upload your own, Feedly Al extracts your sections and replicates your writing structure, then automatically gathers supporting sources and populates each section with inline citations from the Feedly Threat Graph. Every claim is verifiable, which matters when you're handing a brief to a CISO or an external stakeholder.

You can adjust the technical level of the output for different audiences, collaborate with teammates in the editor, and refine any section in real time with Ask Al, without breaking the flow of your report. When you're done, export directly to PDF or copy the text to your existing workflow.

Automated Newsletters

Automated Newsletters auto-populate from AI Feeds or Team Boards, with AI-assisted summaries and analyst notes already drafted. Teams set a delivery schedule and let Feedly handle the rest: daily threat briefs for security operations, weekly roundups for the CISO, targeted vulnerability digests for the vulnerability management team.

Deliver intelligence

Sharing the intelligence your team has collected, analyzed, and curated is a key activity of most CTI teams. However, many teams spend hours per day on this part of the process using manual report creation sent through email lists. Feedly makes this easier by providing several ways of sharing the intelligence, from article tagging and Slack integration to fully automated workflows that pass data through the Feedly API to your other security tools.

Team Boards

Team Boards are where analysts curate before they share. Save key articles and Insights Cards to a Board, and configure it to trigger downstream actions automatically with a Slack alert, a newsletter entry, or an API push. Boards work best when named around the audience they serve: CISO, vulnerability team, threat hunters, or incident response.

Integrations and API

The enrichment Feedly extracts (IoCs, TTPs, malware, CVE data, detection rules) can flow directly into your TIP, SIEM, or SOAR via STIX/JSON API, no-code integrations, and MISP support. The time between “Feedly found something” and “your detection rules are updated” can be minutes, not days.

Putting it all together

Leading CTI teams use Feedly across the full intelligence cycle: Intel Agents and AI Feeds for continuous, filtered collection; Insights Cards and Ask AI to move from signal to finished analysis fast; and Automated Newsletters and integrations to get the right intel to the right people without the manual overhead.

The result is a team that spends less time gathering and formatting, and more time doing the analysis work that actually protects the organization.

Want to see it in action?

Try Feedly Threat Intelligence

Start Free Trial

Threat Intelligence

Enrich indicators faster with GreyNoise context built into IoC Insight Cards

Your GreyNoise intelligence now lives in the same place as your OSINT, so you can go from indicator to action faster.

Gaby Zedan

on May 14, 2026

15-Second summary

Assessing an indicator means manually pulling context from multiple tools that don't talk to each other, a process that is slow, error-prone, and creates friction at exactly the moment when speed matters most.

Feedly Threat Intelligence now surfaces GreyNoise enrichment directly inside IOC Insight Cards, bringing open-source and closed-source intelligence together in a single pane of glass, so you can make faster, more confident decisions without ever leaving the platform.

Assessing an IOC

When a CTI analyst is working through an IOC collection workflow, the core question is always the same: is this indicator worth acting on?

Answering it confidently means pulling together multiple signals. OSINT gives you a strong foundation: threat actor associations, malware families, and recent mentions across your source collection. But IOCs have a short lifespan, and forming a complete picture before that window closes requires merging open-source intelligence with enriched data from platforms like GreyNoise. That process is manual by nature, spread across multiple tabs, and easy to get wrong. Until now, it has meant running parallel workflows in order to make a confident call.

Connect Feedly Threat Intelligence and GreyNoise

IOC Insight Cards now bring Feedly Threat Intelligence's OSINT and GreyNoise data together in one place. If you have a GreyNoise license, you can enrich any indicator with GreyNoise's classification signals directly alongside Feedly's validated OSINT layer, which aggregates over 10,000 CTI sources and cross-references indicators against MISP warning lists using NLP models fine-tuned on manually annotated datasets to ensure every indicator is genuinely malicious before it surfaces. This is where open-source and closed-source intelligence meet.

The result is a richer, more complete picture of every indicator. OSINT context tells you who is behind a threat. GreyNoise's behavioral signals tell you what that threat is actively doing and helps you move from raw context to confident actions faster, with all of the intelligence in one place.

A 360-degree view of every indicator

IOC Insight Cards already offer a comprehensive OSINT view of every indicator and it’s related cyberattacks, threat actors, malware families, and more. With GreyNoise data now layered in, you get behavioral and classification signals in the same place as your OSINT context, you get the full picture in one place.

For analysts who triage high volumes of IP indicators, that complete view is the difference between a confident call and an inconclusive one.

IoC Insights Card pulling in GreyNoise intelligence.

Set it up in minutes

Connecting GreyNoise to Feedly Threat Intelligence doesn't require professional services engagement or a backend configuration. You simply bring your existing GreyNoise license, connect it in your account settings, and enrichment surfaces automatically across your IOC Insight Cards from that point on.

Setup page for the GreyNoise integration inside of Feedly Threat Intelligence.

Your data stays yours

Security teams handle sensitive intelligence, and how that data is managed matters. The GreyNoise data you bring into Feedly is visible only to you. It is not stored by Feedly, not shared across accounts, and not accessible to other users in your organization. Your vendor subscription powers your own enriched view and no one else's.

Feedly Threat Intelligence connects with 10+ security solutions

GreyNoise is one of the many integrations available. Start your free trial and see how Feedly Threat Intelligence connects to your CTI workflow.

Start Free Trial

Analyze patterns across 100 cyberattacks with Ask AI in the Cyberattack Intel Agent

Use custom AI prompts to discover campaign patterns, profile threat actors, and generate intelligence reports

Gaby Zedan

on May 06, 2026

15-Second summary

CTI teams are buried in attack data, making it difficult to see what's relevant and then extract insights across attacks. The Cyberattack Intel Agent helps you filter through that data to the attacks that matter to your organization. Ask AI is now available in the Cyberattack Intel Agent to help you analyze attack patterns so you can act fast.

Run your own prompts across multiple attacks:

• to quickly assess attack vectors and understand how threat actors operate.
• to surface campaign patterns, profile threat actors, extract TTPs, and turn raw attack data into ready-to-share intel in minutes.

Here are seven use cases that show what that looks like in practice.

Overview

There's roughly one cyberattack every 39 seconds; that's over 2,200 attacks per day. For CTI analysts, the challenge isn't just keeping up with the volume, but making sense of it fast. They need to quickly identify patterns across multiple attacks, connect related campaigns, and understand how threat actors are evolving their tradecraft. This requires hours of manual comparison, and even then, critical connections can get missed.

Ask AI in the Cyberattack Intel Agent brings personalized AI prompting into your existing threat research workflow. Analysts can run custom queries across up to 100 cyberattacks at once to surface patterns and insights that would otherwise take hours to piece together.

From assessing specific threat actors and mapping active campaigns to generating reports tailored to your stakeholders, Ask AI transforms your workflow from manual, time-consuming attack-by-attack analysis into fast, comprehensive intelligence.

Example 1: Threat landscape overview

Use this prompt to generate a structured, 30-day intelligence report on cyberattacks targeting your region and industry and provide a ready-to-share briefing that keeps stakeholders aligned on sector-specific risks over time.

Cyberattack Intel Agent filter combinations:

Add your time period, industry, and region, and the ‘Recently Reported’ filter.

Ask AI Prompt:

Based on the selected attacks, generate a threat landscape overview for [region] and [industry]. Include the most active threat actors, predominant TTPs, commonly targeted assets, and any clustering in campaign activity that reveals how the threat environment is evolving within this dataset.

Ask AI Response:

Example 2: Attack Vector Assessment

Quickly assess how attackers gained their foothold by extracting and analyzing the attack vectors behind incidents. For each vector, you can surface what was exploited, how it was leveraged, and why existing controls failed to stop it, then walk away with a prioritized list of the highest-risk entry points to close before the next wave hits.

Cyberattack Intel Agent filter combinations:

Add your time period, threat actor(s) and region.

Ask AI Prompt:

Given the following incidents, identify and summarize the attack vectors the threat actor used to succeed. For each vector, explain: (1) what it was, (2) how it was exploited, and (3) why it worked (e.g., misconfiguration, human error, unpatched vulnerability, weak controls). Present the vectors in chronological order based on when each was exploited. Conclude with a prioritized list of the most critical entry points to address, ranked by severity and likelihood of recurrence.

Ask AI Response:

Example 3: Threat actor research

Build a comprehensive profile of the new threat actors behind attacks by surfacing each actor's known motivations and sponsorship ties, TTPs, targeted sectors, and recent behavioral shifts. This gives you the intelligence foundation to anticipate their next moves, assess your organization's exposure, and keep stakeholders informed on who is actively operating in your threat landscape.

Cyberattack Intel Agent filter combinations:

Add your time period, the ‘New Threat Actors’ filter.

Ask AI Prompt:

Which threat actors are most active across these attacks? Create a threat actor profile for each, including an executive summary, identity and attribution, motive, victimology, capability assessment, modus operandi, strategic analysis, technical appendices, and references.

Ask AI Response:

Example 4: TTP and IoC research

Use this prompt to surface what's new across the attacks in your Intel Agent. Ask AI will identify novel techniques, tactics, and procedures being leveraged in recent activity, along with associated IoCs, so you can update detections, refine hunting queries, and track how your known threat actors are evolving their tradecraft.

Cyberattack Intel Agent filter combinations:

Add your time period and your Threat Actors’ Intel Profile (personalized combinations of AI Models you can save and reuse across your AI Agents and AI Feeds for richer context).

Ask AI Prompt:

What novel TTPs and IoCs are being leveraged in these attacks?

Ask AI Response:

Example 5: Data exposure and impact assessment

Ask AI will identify which types of data were exposed, which sectors or organizations are affected, and who is most at risk, providing an impact assessment to quickly scope the extent of a breach.

Cyberattack Intel Agent filter combinations:

Select your time period and Intel Profiles (personalized combinations of AI Models you can save and reuse across your AI Agents and AI Feeds for richer context).

Ask AI Prompt:

For each breach, identify the organization affected and the data exposed. Then assess the third-party risk: if this organization is a vendor, partner, or service provider in my supply chain, what is the potential impact to my business operations? Flag any downstream risks including shared infrastructure, data flows, or dependencies, and prioritize which third-party relationships warrant immediate review or contingency planning.

Ask AI Response:

Example 6: Report generation for leadership

Ask AI will synthesize findings across all ingested attacks and package them into a report your team can share. For instance, if you are briefing your CISO or leadership team, Ask AI will deliver a clear, business-contextualized summary of what's happening, what's relevant to your organization, and where your team should focus next.

Cyberattack Intel Agent filter combinations:

Select your time period, industry, and region.

Ask AI Prompt:

My CISO has been asked about our exposure to the latest wave of attacks in our sector and region. Generate a focused briefing that answers: Are we a likely target? What TTPs should we be watching for, and do we have the controls to detect or stop them? Close with a short, prioritized action list framed around business risk and decision-making, not a full landscape review, just what leadership needs to respond with confidence right now.

Ask AI Response:

Example 7: Visualization

Get a visual breakdown of each phase of the attack chain, from initial access to impact, so you can quickly spot where campaigns converge, identify the most exploited entry points, and communicate the full scope of an attack in a visual manner.

Cyberattack Intel Agent filter combinations:

Add your time period, threat actor, and MITRE ATT&CK Tactic.

Ask AI Prompt:

Visualize the attack chain for these incidents with a diagram mapping each phase from initial access to impact. Highlight the most common entry points, lateral movement techniques, and end-stage objectives across campaigns.

Ask AI Response:

Grounded in real sources and the Feedly Threat Graph

What sets Ask AI apart from generic AI tools is that every query is grounded in the Feedly Threat Graph, a continuously updated map of relationships gathered from 10,000+ sources. This means the response reflects what's actually happening in your threat landscape now. Every answer is also fully cited, so you can trace findings back to their original sources and dive deeper into any piece of intelligence used to build the response.

In short…

Ask AI in the Cyberattack Intel Agent gives CTI analysts a faster way to move from raw attack data to actionable intelligence. With it, you can quickly assess the attack vectors behind any incident, track campaign patterns, assess threat actors, scope a breach, or brief executives, all by running custom queries across up to 100 attacks at once, grounded in the Feedly Threat Graph.

Start uncovering patterns across 100 cyberattacks

Get responses grounded in the Feedly Threat Graph, so patterns, threat actor profiles, and campaign insights surface in minutes, not hours.

Try Ask AI in the Cyberattack Intel Agent

Fundamentals

Navigate Feedly Faster with Go To

Gaby Zedan

on Apr 07, 2026

15-Second summary:

Feedly gives you a powerful arsenal of capabilities to track threats: Intel Agents, Insights Cards, AI Feeds, Boards, and more. Go To makes it easy to navigate directly to the right one, instantly.

Simply hit 'Cmd + K' or click 'Go To' in the left navigation, and go to your recent pages, or type in any actor, malware, vulnerability, or IoC , and instantly see all related features, including Insights Cards, Intel Agents, AI Feeds, and Boards.

Overview

Go To offers an easier way to track your threats by quickly finding what you need in your Feedly account. Just hit Cmd + K (or Ctrl + K on Windows), or click Go To in the left navigation, and search for what you need.

Here's what you can search for:

• Insights Cards: Navigate to any threat actor, malware, CVE, or cyberattack in two clicks.
• Intel Agents, AI Feeds, Folders, and Boards: Find anything you've set up to track in your account by name.
• Recently viewed pages: Shown automatically when you open Go To, so you can pick up right where you left off.

Navigate to any Insights Card in two clicks

Go To lets you find any Insights Card by typing the threat actor, malware family, or vulnerability you are looking for. The matching Insights Card appears right in the results for easy access.

Find AI Feeds, Folders, and Boards by name

With Go To, you can type the name of any saved AI Feed, Folder, or Board and jump straight to it, no need to toggle through Folders or remember where things are organized.

Pick up where you left off

When you open Go To, it automatically shows your recently viewed pages. This means you can jump back to whatever you were tracking with a single click, without relying on your browser's history or back button.

Threat Intelligence

Introducing Feedly ThreatBeats: Your daily intel jingles

Get the briefs you care about delivered in your favorite music genre, because every CVSS score deserves a soundtrack.

Shawn Jaques

Gaby Zedan

on Apr 01, 2026

15-Second summary

Do CTI analysts really need another podcast? No. Do they need Scattered Spider TTP updates with an indie/emo vibe? Absolutely yes. Have we been told this is a terrible idea? Multiple times. Are we doing it anyway? You're already reading the blog.

Feedly ThreatBeats turns your daily threat intelligence into a personalized mix tape, because why read about APT activity when you can dance to it?

With this new feature, you can:

• Get your morning threat brief delivered as a full track, covering new CVEs, emerging campaigns, and threat actor drama. Risk Sync Mode (RSM) adjusts the tempo and genre based on each threat's severity. CVSS 8? Smooth jazz. Industry cyberattack? Death metal.

This blog walks you through how ThreatBeats works and lets you preview sample tracks. We are deeply sorry in advance.

The problem with threat intelligence (besides the threats)

Every morning, CTI analysts open their queues to find dozens of unread reports, vendor advisories, and a "quick RFI" from the CISO that is never quick. The intel is critical. The format is a punishment. Somewhere between the third threat actor profile, written entirely in the passive voice, and your second cup of coffee, the signal gets lost. No wonder CTI burnout is real.

ThreatBeats fixes this by bypassing the part of your brain that has given up on vendor reports and routing directly to the part that still feels things. Instead of reading that a financially motivated threat actor is actively exploiting a critical authentication bypass, you hear it, and sometimes you feel it in your bones. Why? The Feedly AI has correctly assessed this as a thrash metal situation. Your threat queue becomes a setlist. Your morning briefing becomes something you might actually finish.

Here are a few examples of the tunes you can expect:

Root Access and Regret

Every country song is about losing something. A truck. A dog. Root access to your entire Docker container because you trusted the vm module. This one's no different.

83 Million Downloads ft. The Axios Attack

The Axios supply chain attack was so calculated, so precise, and so self-destructing that it honestly deserved its own soundtrack. We just gave it one.

The Call (A Social Engineering Ballad) by ShinyHunters

ShinyHunters got the Broadway treatment because this attack was a show-stopper.

One Server to Fall

A Chinese-nexus threat actor turned a trusted government video conferencing platform into a malware delivery channel. If that doesn't deserve a mosh pit, nothing does.

Lullaby for the Exploit Market

Someone built a full-chain iOS exploit kit. Someone else bought it. Someone else opened it. Lo-fi because everyone involved clearly needs to calm down.

That's a wrap

Threat actors don't take days off, zero-days don't wait for business hours, and the brief is never as short as the name implies. You're out here tracking APT campaigns, triaging CVEs, and explaining to leadership why "we have a firewall" is not a security strategy. The least we can do is make the threat landscape sound a little better. ThreatBeats isn't real, but the respect is. Now go warn somebody about something.

Are your mornings (and days and nights) too noisy?

Try Feedly Threat Intelligence for free and see how they get a little calmer and a lot more productive. We promise the actual product is way more useful than this blog.

Try Now

FAQs

Threat Intelligence

6 practical ways to use the Feedly API to operationalize threat intelligence

Learn how security teams can pull enriched, structured threat data from Feedly into their own tools and workflows

Aaron O'Maley

on Mar 31, 2026

Introduction

Not every CTI workflow needs to start and finish in the Feedly UI.

The Feedly Threat Intelligence API gives you programmatic access to everything that makes Feedly useful: Intel Agents, Ask AI, AI Feeds, Boards, Insights Cards, and the millions of relationships in the Real-Time Threat Graph, so you can pull enriched, contextualized intelligence directly into the tools and workflows your team already relies on.

Whether you're feeding a TIP, pushing alerts to a SIEM, or building a custom internal system, the API lets you automate the collection, processing, and analysis steps that would otherwise require manual effort inside the Feedly UI.

In this post, we'll cover how the API works and walk through six practical ways to use it to streamline and scale your threat intelligence operations.

How to use the Feedly Threat Intelligence API

Feedly’s REST API makes it easy to integrate threat intelligence into your existing workflows. With a few simple steps, you can automate the sharing of high-value intelligence with leadership, operations, and other tools in your stack.

Step 1: Generate an API Access Token

If you're on the Feedly Threat Intelligence Advanced plan, you can generate a personal API access token directly from the self-service section of the Feedly app.

Step 2: Identify the Stream ID

Locate the stream ID of the folder or Board you want to access. This ID is used to tell the API what data to retrieve or act on.

Step 3: Make REST API Requests

The Feedly API follows RESTful conventions, using standard HTTP methods like GET, POST, and DELETE. All requests and responses use JSON formatting, making it simple to integrate with modern workflows and tools.

Example 1: Enriching custom dashboards

Many customers integrate Feedly with analytics and visualization platforms like Power BI and Azure Data Explorer to gain deeper threat insights. They pull in enriched articles from Feedly that include context such as CVEs, TTPs, malware, and threat actors, and correlate that intelligence with data from other sources, including closed-source reports, dark web monitoring, and internal telemetry. This creates a more comprehensive and connected view of the threat landscape.

Example 2: Summarize content with Ask AI

One effective way to use the API is to pull article content on top stories and use Ask AI to automatically synthesize it. Ask AI can summarize key points or identify related indicators, giving users the flexibility to analyze single articles or groups of articles. This helps extract data, highlight themes, break down technical details, and format customized output.

Here are just a few examples of how to use Ask AI in the API:

• Cross-reference TTPs: Automatically query a folder or an AI Feed for TTPs associated with a threat actor as new articles are collected.
• CVE analysis and enrichment: Query new critical CVEs affecting your tech stack to return structured data on exploits, affected systems, and CVSS.
• Diamond Model analysis: Programmatically generate a full analysis when a tracked threat actor is associated with a behavioral change.
• Automate recurring deliverables: Schedule daily threat summaries to run against your PIRs and deliver specific, formatted output.

Prompt

I used the prompt here: Generate threat hunt hypothesis to create a workflow where you can save articles to a Board and then run a cron job to generate hypotheses via Ask AI.

Output

The output of the script is saved in this Notion page.

Example 3: Ingesting Feedly data into a security tool

Feedly Threat Intelligence offers no-code integrations with several popular security tools, including Splunk, Anomali, Microsoft Sentinel, and MISP (see the full list). For tools that are not yet supported with no-code options, users can build custom integrations using the Feedly API. This flexibility allows teams to seamlessly integrate Feedly with their existing security stack, automate workflows, and ensure threat intelligence is delivered quickly to the right tools.

For more sample customer scripts, visit: https://github.com/feedly/sample-customer-scripts/tree/main

Example 4: Identify changes to vulnerabilities

The criticality and priority of vulnerabilities can shift as new information becomes available, such as updated CVSS scores, newly discovered exploits, or patch releases. However, tracking when these updates change the status of a vulnerability can be challenging. Some Feedly customers use the API to extract data from the Vulnerability Intel Agent into a separate database. By comparing each version of the data to previous pulls, they can detect changes and trigger notifications through tools like Slack or Microsoft Teams.

Example 5: Facilitate remediation workflows in service management tool

Many security teams already live in service management tools like ServiceNow. Feedly's API lets them stay there, surfacing threats from Feedly and pushing them directly into their existing remediation workflows, where tickets get created, prioritized, and tracked automatically. It removes context switching and ensures that critical issues are tracked, prioritized, and resolved through established IT processes.

Example 6: Automate threat hunting

Integrating Feedly with a SOAR platform enables security teams to automate the ingestion and analysis of threat intelligence, streamlining threat-hunting workflows. Using the Feedly API, the SOAR connector can pull fresh indicators of compromise (IoCs) enriched with context such as malware, threat actors, CVEs, products, and TTPs. Then, each night they can run automated checks to flag any IoCs that match threat-hunting criteria. By the time analysts start their day, they have a prioritized list of threats, complete with the context needed to investigate.

Secure Cyber Defense explains this in more detail in this case study.

Want to learn more about setting up the Feedly API?

Visit: https://developers.feedly.com

But wait, there’s more...

We’ve only scratched the surface of what you can do with the Feedly API. Got an interesting use case that you want to explore? Contact your sales rep, TI advisor, or schedule a demo.

Start Free Trial

Threat Intelligence

Get threat intelligence to your team fast, in the tools they already use

Updated integration for Microsoft Teams brings curated intel directly into your stakeholders' workflows

Shawn Jaques

on Mar 17, 2026

15-second summary

Feedly's Microsoft Teams integration just got significantly better. The updated integration, now available on the Microsoft Marketplace, gives CTI teams more control over how intelligence reaches stakeholders, with built-in deduplication, AI-generated summaries, and automatic translation.

For most CTI teams, the workflow doesn't end with finding intelligence. It ends with making sure the right people act on it. The updated integration is built to make it easier to get the right intel to the right people, without the noise.

Route intelligence to the people who need it, without adding friction

The integration lets you connect your Feedly Team AI Feeds and Boards to any Microsoft Teams channel. From there, you can create dedicated channels for specific needs or audiences. For instance, you could create threat categories, including ransomware activity, CVE disclosures, threat actor tracking, and sector-specific threats, and route intel to each one automatically. Alternatively, you could create channels for different stakeholders, such as the SOC team, the vulnerability management team, and leadership, and route appropriate intel to each group.

For stakeholders who don't live in Feedly, this changes the experience entirely. Instead of waiting for a report or digging through a shared inbox, they get a timely, relevant alert in a channel they're already monitoring.

Stay focused on the signal

One of the most common complaints CTI teams hear from stakeholders is "we're getting too much, and we can't tell what matters."

Feedly can automatically deduplicate articles, so when multiple sources cover the same event, stakeholders see it once, not five times. Each notification can also include a concise AI-generated summary, so your team can assess relevance in seconds and decide whether to dig deeper.

The result is a channel that feels curated rather than overwhelming.

Expand your coverage without expanding your workload

Threat actors don't operate in a single language, and neither do the sources that track them. The integration supports automatic translation of article titles and summaries from dozens of languages into English (available on plans that include Multilingual), so your team can monitor regional sources and non-English threat reporting without manual effort.

For organizations with exposure across multiple geographies, this helps minimize blind spots and accelerate time to notification without adding headcount or process.

Summary

The Feedly integration for Microsoft Teams gives CTI teams a direct line to the stakeholders who depend on their work. By pushing relevant, deduplicated, and translated intelligence into the channels your organization already uses, you reduce the gap between insight and action and make it easier for everyone to stay informed without changing how they work.

Keep your team informed on real-time intelligence

Updated integration for Microsoft Teams brings curated intel directly into your stakeholders' workflows.

Connect Feedly to MS Teams

FAQs

Threat Intelligence

Tracking the cyber consequences of geopolitical events

How CTI analysts can monitor geopolitical activity to defend against emerging cyber threats

Alessandro Magi

on Mar 11, 2026

15-second summary

Recent geopolitical tensions in the Middle East are a reminder that armed conflict increasingly has a cyber dimension. CTI analysts need to ensure their organizations are prepared to defend against downstream consequences that could affect them. This means understanding the actors, the latest developments, who they are targeting, and their techniques, using sources in multiple languages.

Here’s how Feedly can help with this and similar global threats as they emerge.

• Multi-language AI Feeds to monitor conflicts in local languages of the affected countries, reporting in 15 languages, including Arabic, Russian, and Chinese, in addition to English.
• TTP Intel Agents to track related state-sponsored and hacktivist groups, and get alerted as their tactics evolve.
• Threat Actor Insight Cards for quick, structured overviews of each actor’s capabilities, targeted sectors, and recent activity. Use Ask AI to tailor your research.
• Automated intel reports and newsletters to push a curated daily brief on conflict-linked cyber activity to your team.

We’ll walk you through six steps to go from initial research to ongoing monitoring to daily dissemination.

How to use Feedly to track geopolitical events in real time

Step 1: Use Ask AI Research to get a quick summary of the cyber threats associated with the conflict

Ask AI Research is quick and grounded in the Feedly Threat Graph. When you ask a question, it quickly researches related articles, associated threat actors, and more, and provides links to sources for deeper investigation.

Using the recent escalations of the US-Iran-Israel conflict from February 2026 as an example, you could quickly get an understanding of the primary cyber threats, relevant threat actors, and the TTPs they’ve used.

Step 2: Pivot into Threat Actor Insights Cards, quickly get up to speed

From that Ask AI Research, you can see the associated Threat Actor Insights Cards. Pull up the Insight Cards for each group to get a clear baseline on capabilities, past attacks, and known targeting. You’ll get real-time threat actor profiles to help you contextualize incoming threat reporting without spending hours researching each actor.

Step 3: Configure Cyberattack Intel Agents to monitor key activity in the region

Create a Cyberattack Intel Agent to monitor new attacks in the affected region. In the aforementioned conflict, we could follow all cyberattacks in Middle Eastern countries.

The agent will surface new and updated information about attacks from the moment it’s published, so you're not manually scanning dozens of sources.

Step 4: Build AI Feeds to collect relevant intelligence

Set up AI Feeds for ongoing monitoring and filtering of articles about the geopolitical event and connected threat actors and the TTPs they’re using.

• Use AI Models related to the countries and threat actors involved
• Follow multiple languages, including English, Arabic, Russian, and Chinese
• Follow sources, including:
  • Threat intelligence vendors publishing advisories specific to the geopolitical event (CISA, NCSC, Mandiant, Microsoft MSTIC, etc.)
  • Regional news sources in Arabic that report on cyber activity
  • OSINT communities on Twitter/X and Mastodon tracking the conflict
  • Government and CERT advisories from countries involved or affected by the conflict

You can set up multiple AI Feeds to track different aspects or intelligence requirements related to the geopolitical event. In this example, we follow threat actors and TTPs in the region.

Step 5: Use Ask AI to analyze content in your AI Feed

Accelerate your threat analysis by using Ask AI to synthesize and summarize articles in your customized feed. Ask your specific intelligence questions to get answers grounded in the content you choose.

Prompt

What are the latest TTPs being used by threat actors associated with the US-Israel-Iran conflict? Identify the MITRE ATT&CK T-Codes linked to each TTP, which threat actor is using them, and if there are any TTPs being reported as novel/new that emerged during this conflict. 

Using MITRE D3FEND, suggest defensive mitigations for each MITRE ATT&CK you identify.

Output: Create a table for this information.   

Step 6: Automate a daily geopolitical threat brief

Use Feedly's Report Builder or Automated Newsletters to create standing daily threat briefs tailored to your stakeholders, covering:

• New threat activity
• Relevant government advisories
• Conflict-related geopolitical developments with cyber implications

Automate sending them to your SOC, leadership, and relevant stakeholders each morning to keep them informed without adding too extra manual work to your daily workload.

The bottom line for your organization

Geopolitical volatility isn't letting up, and the cyber threat landscape is shifting with it. CTI teams that can connect those dots and translate them into clear guidance for leadership are the ones proving their program's worth.

Government advisories are helpful, but they're static. You need to get ahead of the threat, monitor it continuously, and make sure your organization has the context it needs to act and mitigate risk.

Feedly is built for sustained, automated monitoring, to give your team the signal, structure, and speed to stay ahead of what's coming.

Track the cyber consequences of geopolitical events in Feedly

When tensions escalate, the cyber threat landscape shifts fast. Feedly helps your team move from initial research to continuous monitoring to automated daily briefs, so you always have the context you need to act proactively.

Start Free Trial

Threat Intelligence

Analyze your closed-source intelligence in Feedly

Upload any PDF and analyze it along with open-source intelligence using Feedly’s Ask AI

Gaby Zedan

on Mar 10, 2026

15-Second summary

Getting the full threat intelligence context means manually synthesizing closed-source reports and matching them against your open-source intelligence feeds, a slow, time-consuming process that pulls analysts away from higher-value work.

Feedly now lets you upload your own PDFs directly alongside your open-source intelligence and use Ask AI to analyze both together, so you can produce richer, more actionable intelligence without the manual overhead.

In this blog, we’ll show you how to use the feature to start saving time and elevate your analysis with more complete context.

Overview

This new capability lets you upload files directly into Feedly and leverage powerful features like Ask AI. It provides a seamless way to analyze your closed-source reports and extract actionable intelligence in seconds.

Since you’re already tracking open-sources in Feedly, this feature bridges the gap between your closed- and open-source context. The result is richer, more accurate, and actionable threat intelligence that accounts for both open and closed-source domains.

Add open-source context from the Feedly Threat Graph

Uploading a file means Feedly can analyze your closed-source intelligence using the Threat Graph which is a continuously updated knowledge base built from over 10,000 trusted cybersecurity sources.

The Threat Graph automatically extracts and correlates key entities from your uploaded files, threat actors, TTPs, malware families, exploited CVEs, and IoCs. When you use Ask AI to analyze a report, you're not just getting a summary of the document; you’ll also get answers informed by the full open-source intelligence picture.

Behind the scenes of Feedly’s Threat Graph analyzing your file and pulling in additional OSINT to give you a more contextualized answer.

See it in action

Use case #1: Monitoring threat actor activity

Upload your new incident response report into Feedly and query Ask AI to cross-reference every TTP against what's currently being reported across the open web. This allows you to validate whether the behaviors documented in the report appear elsewhere in the wild.

Prompt

Based on the uploaded report, which TTPs were used by the threat actor, and are these same techniques being reported in the open web right now? Are other organizations documenting similar behaviors?

Response

Use case #2: Track critical vulnerabilities

If your team receives a dense vulnerability report, Feedly can instantly enrich the CVEs with real-time data from the Threat Graph, including exploit status, threat actor activity, and patch availability. This helps you quickly identify which vulnerabilities are actively exploited, who is using them, and whether fixes are available, connecting your internal findings to the broader threat landscape.

Prompt

Based on the uploaded report, which CVEs were exploited in this incident, are they currently being actively exploited by other threat actors in the open web, and what does the latest reporting say about patch availability and exploit status?

Response

Use case #3: Identify cyberattacks

Your ISAC bulletin, a vendor threat brief, and an industry outlook report all landed this week. Instead of reading through each one separately, you can upload all three into Feedly and Ask AI synthesizes across them. It will identify overlapping threat actors and recurring attack patterns worth keeping an eye out for.

Prompt

Based on the uploaded reports, which attack campaigns are currently targeting my sector across all three sources, are there any overlapping threat actors or patterns?

Response

Use case #4: Collect IOCs

Extract the IOCs directly from your CERT bulletin to check whether they appear in active campaigns on the open web, and attribute them to threat actors and malware families. This gives you real-time context on whether those IOCs are still relevant.

Prompt

Based on the uploaded bulletin, which IOCs are listed, are they currently associated with active campaigns in the open web, and what threat actors and malware families are they attributed to?

Response

Conclusion

The four use cases above are just the beginning. Any closed-source report in your workflow (government advisories, ISAC bulletins, incident response reports, vendor assessments) can be uploaded into Feedly and queried however you need. Ask: Which threat actors in this report are still active? Are these CVEs being exploited in the wild? Has anything changed since this advisory was published? Answers can come from your uploaded documents alone, or from both your documents and the open web. You control your workflow and your sources, so you can enrich your threat intelligence and context.

Closed-source and open-source intelligence don't have to live in separate places

Upload your PDFs into Feedly and analyze everything in one workflow, no manual bridging required.

Start Free Trial

Threat Intelligence

Cyberattack Insights Cards: A dynamic 360° attack view

Victims, actors, TTPs, malware, IoCs, and more updated in real-time

Gaby Zedan

on Feb 17, 2026

15-Second summary

Researching a cyberattack typically means jumping between news sites, vendor blogs, and threat intel feeds to piece together what happened, who's behind it, and whether you have any exposure.

Cyberattack Insights Cards consolidate available information about an attack into a single dynamic view that updates as new information emerges. You can:

• Get complete attack context in one place, including threat actors, malware, IOCs, TTPs, CVEs, and a timeline of events, all aggregated from 10,000+ sources and continuously enriched as the situation evolves.

This blog demonstrates how the feature works and how it can accelerate your attack research and reporting.

Overview

When a major cyberattack hits the news, the race to understand what happened begins. Who was targeted? Which threat actor is responsible? What malware was used? Are there IOCs your team should be hunting for?

For most CTI analysts, answering these questions means opening dozens of browser tabs and jumping between news articles, vendor blogs, threat intel feeds, leak sites, and social media. You're manually piecing together fragments of information while trying to build a coherent picture, all as the situation continues to evolve.

The Cyberattack Insights Cards provide a 360° view of a specific cyberattack with all the context you need to assess the potential threat quickly.

How Cyberattack Insights Cards work

Behind every Cyberattack Insights Card is Feedly's Threat Graph, which constantly processes and analyzes content from over 10,000 trusted cyber sources. Using machine learning models, Feedly AI extracts and correlates key entities from this content: victims, impacted industries, threat actors, malware families, exploited CVEs, IOCs, and TTPs. As Feedly continues monitoring sources, all entities linked to the attack are continuously updated.

Behind the scenes of using the Feedly Real-time Threat Graph to create a Cyberattack Insights Card.

What's inside a Cyberattack Insights Card

When you open a Cyberattack Insights Card, you get a structured view of everything Feedly’s Threat Graph has collected about the attack.

• Top-level information for immediate context: when the attack was first reported, last updated, article count, and key attributes like attack type, threat actors, malware, and impacted industries.
• Attack summary providing a dynamic, AI-generated overview synthesized from multiple sources with inline citations. It updates automatically as new information emerges.
• Victim information with details about the targeted organization.
• IOCs exportable in STIX 2.1, MISP, or CSV formats for integration with your security tools.
• Timeline of events showing how the attack unfolded chronologically.
• Associated threat actors, malware, TTPs, and CVEs with clickable links to their respective Insights Cards for deeper investigation.
• Article count graph visualizing coverage trends over time.
• Articles with links to original sources when you need to verify details or go deeper.

ShinyHunters Breach Salesforce via OAuth Exploit Insights Card.

Ask specific questions about a cyberattack with Ask AI

One of the most powerful features in Cyberattack Insights Cards is Ask AI. It analyzes all the content from the Insights Card and produces tailored responses in seconds, whether you need a technical breakdown for your team, an executive summary for leadership, or answers to specific questions about the attack itself. What sets Ask AI apart from general AI tools is the context behind every answer: Feedly automatically grounds your prompt in relevant, curated intelligence, so the responses are more accurate, more specific, and ready to copy directly into reports, emails, or documentation with no manual synthesis required.

Using Ask AI to discover other ShinyHunters campaigns and respective patterns for attacks on SaaS platforms.

In short…

Cyberattack Insights Cards transform how you research and respond to attacks. Instead of manually hunting across scattered sources and struggling to keep up with evolving incidents, you get a single, comprehensive view that updates automatically as Feedly’s Threat Graph learns more.

Whether you're conducting deep-dive analysis, responding to stakeholder questions, preparing for briefings, or monitoring ongoing incidents, Cyberattack Insights Cards provide the complete context you need without the manual research burden.

Go from discovery to actionable intelligence in minutes

Explore cyberattack details, track timelines, and uncover threat actor connections with Feedly's Cyberattack Insights Cards.

Start Free Trial

Threat Intelligence

Vulnerability Intel Agent: 7 ways to use CVSS Vector filters for smarter CVE prioritization

How to filter vulnerabilities by attack vector, complexity, and real-world impact

Andrew Castro

on Feb 03, 2026

Feedly's Vulnerability Intel Agent now includes powerful CVSS Vector filters that give you precise control over CVE prioritization based on attack methods and impact. Instead of relying solely on CVSS scores, you can now target vulnerabilities based on how they're exploited and what systems they affect.

Filters use Boolean logic (AND/OR/NOT) across different attributes, including the new CVSS Vector components that break down vulnerability characteristics by attack surface and necessary conditions.

Here are seven examples showing how CVSS Vector filters help you quickly find the vulnerabilities that pose threats to your environment.

Understanding CVSS Vector components

The new CVSS Vector filters turn abstract CVSS scores into practical intelligence:

Attack Vector tells you the vulnerability's accessibility. Network means reachable from anywhere online. Adjacent Network means the same network segment. Local requires system access. Physical requires in-person access.

Privileges Required indicates if an attacker needs existing system rights. “None” means unauthenticated attacks. “Low” means a basic user could exploit it. “High” would require admin or system access to exploit the CVE.

User Interaction shows if social engineering or user action is needed. “None” implies it’s a fully automated exploitation. “Required” means you have a window to detect and block.

Impact Scope (Confidentiality, Integrity, Availability) clarifies the threat. High “availability” impact means service disruption. High “confidentiality” indicates data exposure. High “integrity” would include a system compromise or data modification.

Scope Change shows if the vulnerability crosses trust boundaries. “Changed scope” implies lateral movement, privilege escalation, or cross-component attacks are now possible.

Example 1: Which unpatched vulnerabilities require zero attacker preconditions and are likely to be exploited?

Identify the most aggressive class of threats: those that are actively exploited and can be exploited upon delivery. This filter combines real-world exploitation status with "wormable" characteristics (no privileges required, no user interaction). Since these vulnerabilities don’t have any patch available, consider implementing compensating controls or detection mechanisms around affected systems.

Filter configuration

(Privileges Required: None) 
AND 
(User Interaction: None) 
AND 
(Exploited) OR (Proof of Concept) OR (Weaponized) OR (CISA KEV) 
AND 
(Attack Vector: Network)
NOT 
(Patched)

Result

Vulnerability Intel Agent showing actively exploited wormable vulnerabilities.

Example 2: Which remote vulnerabilities threaten your service availability?

When your organization relies heavily on service availability, you need to identify vulnerabilities that could result in remotely exploitable denial-of-service attacks. This filter combines high availability impact with a network attack vector to reveal vulnerabilities that could allow remote attackers to knock your services offline. These high-impact risks and threats are a key concern for customer-facing apps and core infrastructure, where downtime directly impacts your business.

Filter configuration

(Availability Impact: High) 
AND 
(Attack Vector: Network)

Result

Filtered to show remote vulnerabilities with high availability impact.

Example 3: Which exploited CVEs are most likely to be remotely exploited?

Identify vulnerabilities that are actively being exploited AND can be exploited remotely. This filter focuses on vulnerabilities that have a proof of concept or have been proven to be exploitable and reachable across the network. Combining real-world exploitation evidence with a network attack vector confirms that adversaries are already using these techniques or will likely at least try; verify if your externally facing infrastructure has been targeted.

Filter configuration

(Exploited) OR (Proof of Concept) OR (Weaponized) OR (CISA KEV) 
AND 
(Attack Vector: Network)

Result

Filtered to actively exploited network-reachable CVEs.

Example 4: Which remote vulnerabilities pose a major risk of data theft?

Protect your organization from external data breaches by targeting vulnerabilities that could allow a remote attacker to compromise the confidentiality of your data. By combining high confidentiality impact with a network attack vector, you identify CVEs that allow the exfiltration of or access to sensitive information, such as customer records or proprietary code, without requiring physical or local access to the system.

Filter configuration

(Confidentiality Impact: High) 
AND 
(Attack Vector: Network)

Result

Vulnerability Intel Agent showing remote vulnerabilities with high data theft risk.

Example 5: Which vulnerabilities expose data without user interaction?

Find "silent" risks where data is exposed without a user clicking a link or opening a file. High confidentiality impact combined with no user interaction means attackers can automate data theft. These vulnerabilities are particularly dangerous for backend systems and databases that process sensitive information, as exploitation can occur in the background without alerting staff.

Filter configuration

(Confidentiality Impact: High) 
AND 
(User Interaction: None)

Result

Filtered to show silent data exposure vulnerabilities.

Example 6: Which vulnerabilities are low hanging fruits for threat actors?

Attacks with low Attack Complexity require minimal effort to exploit but can have a great impact on your network and are like low-hanging fruit for threat actors. Add in the network vector, and threat actors can attack these vulnerabilities remotely. These attacks are usually some type of injection, or Cross-Site Script.

Filter configuration

(Attack Complexity: Low) 
AND 
(Attack Vector: Network)

Result

Filtered to show low complexity remotely exploited vulnerabilities.

Example 7: Which vulnerabilities allow lateral movement (scope change)?

Track scope-changed vulnerabilities because they can expand the attack surface beyond the initially vulnerable component. When the scope changes from "unchanged" to "changed," the vulnerability can impact systems outside the directly vulnerable component. When paired with network or adjacent network attack vectors, these CVEs represent dangerous situations in which compromising one system can lead to unauthorized access to others. This is particularly critical in cloud deployments, containerized environments, and segmented networks, where lateral movement can cause a cascade failure.

Filter configuration

(Scope: Changed) 
AND 
(Attack Vector: Network) OR (Attack Vector: Adjacent Network)

Result

Filtered to CVEs enabling lateral movement.

Start prioritizing with CVSS Vector filters

CVSS Vector data can do more than help you prioritize patches. Vulnerability management is actually a good place to start threat hunting because you're working with real weaknesses in your stack, not theoretical threats. Identify the vulnerabilities that are in your environment using scan results and then apply these filters to begin discovering attack paths that may exist.

Try the Vulnerability Intel Agent available in Feedly Threat Intelligence

Prioritize CVEs by how they're exploited, not just their severity score.

Start Free Trial

Threat Intelligence

Ask AI on Threat Actor Insights Cards: Accelerate adversary research with custom queries

Ask questions to extract the exact intelligence you need, with citations to verifiable sources

Shawn Jaques

on Jan 27, 2026

15-Second summary

Profiling threat actors can require synthesizing dozens of intelligence reports across multiple sources. Threat Actor Insights Cards provide comprehensive adversary profiles that you can now query with Ask AI.

With Ask AI on Threat Actor Insights Cards, you can:

• Research adversaries faster and with more precision by asking specific questions about campaigns, TTPs, targets, or behavioral shifts. Then, verify the output through citations to the original sources in the Feedly Threat Graph.

We provide six examples to show how it can accelerate your threat actor profiling.

Overview

When a new campaign emerges or an adversary shifts tactics, you need answers fast. Threat Actor Insights Cards help consolidate intelligence about them into a single place. It looks at the most recent OSINT reports, vendor advisories, blog posts, and technical write-ups, all backed by the Feedly Threat Graph. However, you might want the data in a different format or dive deeper with specific queries.

Ask AI on Threat Actor Insights Cards makes it easy to dive deeper, extract specific data, or create threat briefs in a specific format. You can ask specific questions, such as "What infrastructure has this group used in the last 90 days?" or "Which TTPs are they using most frequently?" and get precise, cited answers. The Feedly Threat Graph provides the AI with rich context, so you get precise, actionable answers in the format you need.

Example 1: Customize your executive summary

There’s no single “best” executive summary for all stakeholders. Depending on their needs, they might want it more business risk-focused or more technical. You can use Ask AI to create a summary tailored to your team or stakeholders.

Ask AI Prompt

Generate an executive summary about this Threat Actor for my CISO and the board. 

Write a 4–5 sentence, non‑technical summary of the threat actor suitable for an executive threat brief, covering: who they are, what they want, who they target, and why they matter this quarter. 

Avoid jargon but keep it specific and action‑oriented.nical sophistication), and Victim (sectors, geographies, selection criteria).

Ask AI Response

Example 2: Diamond Model analysis

A Diamond Model is a structured way of turning raw threat data into actionable intelligence by revealing the connections that matter for detection, attribution, and defense. It can help you identify patterns across campaigns or identify pivot points for deeper analysis. Ask AI can instantly create the Diamond Model so you can focus on cross-adversary analysis.

Ask AI Prompt

Conduct a comprehensive Diamond Model analysis. Include: Adversary (attribution, motivations, capabilities), Infrastructure (domains, IPs, hosting, C2), Capabilities (malware, tools, TTPs, technical sophistication), and Victim (sectors, geographies, selection criteria).

Ask AI Response

Example 3: Dive into key tactics

Often, you just want a quick analysis to understand part of the attack chain. You can simply query the Threat Actor Insights Card to find evidence of how they gained initial access, for example.

Ask AI Prompt

How did this Threat Actor gain initial access to victim environments?

Ask AI Response

Example 4: Understand how behaviors are changing

Most CTI teams have identified a target list of adversaries. They understand these actors well and perform hunts for suspicious behavior. But how do you keep up with their changing behaviors? And how do you quickly develop an understanding of new threat actors who move into your space? You can use Ask AI to help you understand historical behavior patterns and how those have shifted over time.

Ask AI Prompt

Describe the historical targeting pattern of this threat actor: primary regions, industries, victim size (SMB/enterprise/government), and common initial access vectors. Highlight any changes or expansions in targeting over the last 12–24 months.

Ask AI Response

Example 5: Evaluate potential risk to your organization

You hear about new threat actors all the time. In Feedly, you can even monitor for new threat actors targeting companies like yours. Now that you have identified a potential risk, how do you evaluate that risk? You can use Ask AI to analyze historical attack patterns against targets like your company and to assign a risk score, showing the factors used in that assessment.

Ask AI Prompt

Assume my organization is in the [Industry] sector and operates mainly in [Region]. Assess the relevance and risk of this threat actor to my environment. Rate overall risk (1-10) and list the 3 most relevant factors driving that assessment.

Ask AI Response

Example 6: Create intelligence that your SOC can act on now

Arm your SOC team with the technical intelligence elements they need to implement defenses quickly.

Ask AI Prompt

Given what is publicly known about this threat actor’s TTPs, list 5 concrete detections,monitoring, or mitigations a SOC can implement within 1–2 weeks. Reference specific behaviors (e.g., known lateral movement style, C2 patterns) rather than just generic technique names. Include IoCs, detection rules, or any other details to help them take action.

Ask AI Response

Get answers, not just data

Try Ask AI in Threat Actor Insights Cards and extract the exact intelligence you need, with citations to verifiable sources.

Start Free Trial

Threat Intelligence

Research IoCs with rich context in seconds, not hours

Connect indicators to threat actors, malware, and cyberattacks automatically

Shawn Jaques

Olivia Malterre

on Jan 21, 2026

15-Second summary

IoCs often lack reliable context. They're either unattributed or misattributed, forcing CTI analysts to spend time validating intelligence before they can act. Feedly's Real-Time Threat Graph and MISP verification automates IOC context enrichment and helps reduce false positives.

With Feedly's enhanced IoC capabilities, you can:

• Research IoCs and uncover related context, including cyberattacks, threat actors, or malware
• Collect IoCs via Feedly's API and pull STIX-formatted context into your TIP, SIEM, or SOAR

Feedly now tracks more IoC types (adding SHA-1, SHA-256, MD5 hashes, and IPv6 addresses) with better validation and greater context. Customers report 5X faster research and fewer wasted validation cycles.

Challenge

Researching IoCs that lack reliable context is often a bottleneck to validation. Unattributed or misattributed intelligence forces you to manually verify each IoC before you can act on it, turning what should be quick research into time-consuming investigative work. These validation cycles drain resources and delay response when speed matters most.

Feedly's enhanced IoC capabilities automate context enrichment across more indicator types, including SHA-1, SHA-256, MD5 hashes, and IPv6 addresses. The Real-Time Threat Graph and MISP Warning List verification connect threat actors, malware, and cyberattacks to IoCs while minimizing false positives. Whether you're doing manual research or running automated workflows in SOAR, Feedly helps you validate and triage faster.

Research an IoC and discover its related cyberattacks, threat actors, or malware

Enter an IoC into Ask AI Research to instantly see its connections mapped across data from 10,000+ sources. Our automated enrichment surfaces related threat actors, malware families, and campaigns, and lets you jump directly to VirusTotal or Shodan for additional verification. You get verified context that eliminates guesswork, not a raw list of indicators.

Enter an IoC into Ask AI Research to see a summary and relationships

Click into an Insights Card to investigate further

Link directly to IoCs in VirusTotal or Shodan

Collect IoCs via Feedly's API and pull STIX-formatted context into your TIP, SIEM, or SOAR

Integrate IoC enrichment directly into your existing workflows through Feedly's API. Query any hash or IP address programmatically and receive structured intelligence about associated threat actors, malware, and cyberattacks. Push enriched intelligence into your TIP, SIEM, or SOAR via STIX-formatted feeds, providing automated context for your detection and response tools. Your team gets consistent, verified attribution without switching interfaces or manual work.

In summary

IoC research no longer needs to be a time sink. Feedly's enhanced IoC capabilities give you automated context enrichment across more indicator types, verified attribution through the Real-Time Threat Graph, and seamless integration with your existing security stack. Now you can deliver enriched IoCs with higher confidence for the threats that matter.

FAQs

Threat Intelligence

Surface top threats in CTI newsletters

Sort by 'Top Stories' to identify and share highly covered threats with your stakeholders

Shawn Jaques

on Jan 20, 2026

15 Second-summary

Communicating the most relevant, timely threats to your stakeholders often requires constantly searching through your feeds for the most impactful stories.

The new Top Stories sort saves you time, automatically putting high-impact, trending stories from any AI Feed or Folder at the top of your newsletter.

Send newsletters with stories ranked by importance using Feedly AI's Top Stories sorting.

Here's how to use Top Stories sorting to save time while delivering relevant threat intelligence your team can quickly digest and act on.

Automatically identify and add the top trending cybersecurity stories from any Al Feed or Folder

When you sort Folders or Al Feeds by Top Stories, Feedly Al will organize newsletter content by source coverage, putting high-impact, trending stories front and center. This ensures your newsletter is engaging and informs your team on the must-know events affecting your threat landscape.

Newsletter pulling from a Critical Vulnerabilities AI Feed that’s been sorted by Top Stories, showcasing the most pending stories at the top.

Bonus: Use personalized prompts on Top Stories to extract additional intelligence tailored to your stakeholders' needs

Once your content is sorted by Top Stories, run an AI Overview Prompt to transform raw threat intelligence into digestible insights, explaining not just what happened, but why it matters and how your stakeholders should respond.

Running an AI Overview Prompt on Top Stories about Critical Vulnerabilities to extract actionable recommendations, mitigation and patching.

Learn more about Al capabilities in Automated Newsletters here: Al in Threat Intelligence Newsletters: Faster creation, bigger impact

In short..

Sorting your Automated Newsletters by Top Stories saves cyber threat intelligence teams time by automatically surfacing the most widely reported threats across their AI Feeds and Folders. The vulnerability use case above is just one example; this feature is fully customizable to your team's specific needs.

Want to see how this works for your team?

Start a free trial, we'll help you get started.

Try Now

FAQs

Market Intelligence

The Scanner: Exploring Potential Futures

Next- Part 5

Tino Klaehne

on Dec 04, 2025

Introduction to the Scanner

The fifth article in our Building Modern Strategic Intelligence series explores the final and most forward-looking component of the InsightOS framework: The Scanner. After covering the NOW (Monitor) and NEW (Radar) horizons, we turn to the NEXT horizon, where organizations explore potential futures to inform long-term strategy and innovation.

While many organizations engage in periodic future-thinking exercises, few develop the capabilities for ongoing future exploration. The Scanner function transforms occasional futuring workshops into an integrated organizational capability that continuously maps potential futures, validates plausible scenarios, and connects long-range possibilities to near-term actions.

This article reveals how leading organizations are developing Scanner functions that go beyond Data Theatre's superficial trend reports to create genuine strategic foresight, capabilities that don't just predict a single future, but explore multiple futures and develop adaptive strategies for different scenarios.

Understanding the Scanner Function

The Scanner function completes the strategic intelligence system, focusing on long-range foresight and future exploration. While the Monitor tracks current events and the Radar detects emerging trends, the Scanner explores potential futures to guide long-term strategy and innovation.

The Scanner function helps organizations move beyond reactive responses to develop strategic foresight. It explores alternative futures, assesses their plausibility, and connects long-range possibilities to near-term actions, instead of extrapolating current trends.

What distinguishes the Scanner function from Data Theatre's superficial future-gazing is:

• Systematic exploration vs. trend extrapolation: The Scanner uses organized methods to map multiple possible futures and their implications, instead of extending current trends.
• Cross-disciplinary convergence vs. siloed predictions: The Scanner identifies how developments across various fields might interact and combine, instead of isolated forecasts within single domains.
• Long-range orientation vs. short-term projection: While Data Theatre focuses on next-year predictions, the Scanner explores longer horizons, typically 5-15 years, where uncertainty creates both risk and opportunity.
• Actionable foresight vs. speculative entertainment: The Scanner links long-term possibilities to current decisions, investments, and capabilities, beyond producing interesting future scenarios.

Mature Scanner functions create competitive advantage through superior anticipation. They do this not by predicting a single future with certainty, but by exploring multiple futures and developing adaptable strategies that work across different scenarios.

Core Questions for The Scanner

The Scanner function helps organizations explore potential futures and prepare for long-term opportunities and disruptions by addressing these questions:

• How do we systematically explore and map potential futures? Beyond trend extrapolation, what frameworks assist us in understanding alternative scenarios and their strategic implications?
• How do we distinguish between plausible futures and speculation? What validation approaches ensure we're focusing on possible futures with solid foundations?
• How can we connect long-range foresight to near-term action? What mechanisms translate future scenarios into present-day strategy and innovation priorities?
• How do we maintain adaptability while preparing for specific futures? What approaches balance commitment to strategic directions with flexibility as futures change?
• How can we harness collective intelligence in future exploration? What collaborative methods improve our ability to sense, interpret, and respond to emerging futures?

The Scanner function transforms these questions from occasional thought exercises into systematic organizational capabilities. It moves beyond the superficial future-casting of Data Theatre toward genuine strategic foresight.

1. Analysis: Gathering Future-Focused Intelligence

Unlike the data feeds powering Monitor or Radar functions, Scanner feeds focus on longer-term developments and cross-disciplinary insights. They combine established forecasting methodologies with speculative exploration to build a comprehensive view of possible futures. This systematic approach moves beyond the superficial "megatrend reports" common in Data Theatre to create genuine strategic foresight.

The Scanner function requires specialized analysis tools that can process diverse inputs and identify potential future states.

Key analysis categories include:

2. Synthesis: Making Sense of Future Possibilities

While Data Theatre often claims to "predict the future" through superficial trend extrapolation, true synthesis in the Scanner function requires systematic pattern recognition and validation. Building on the Triangulation Matrix framework introduced in Part 2, the synthesis phase transforms diverse inputs into validated future scenarios through deliberate correlation and triangulation across multiple dimensions.

Pattern Recognition and Validation Tools

The Scanner function adapts the Triangulation Matrix specifically for long-range foresight, implementing systematic validation across three key dimensions. Unlike Data Theatre's superficial trend projections, this approach ensures future scenarios are thoroughly validated through multiple perspectives and methodologies:

Signal Pairing and Pattern Validation

Signal pairing is particularly valuable in the Scanner function, where connecting diverse signals can reveal emergent futures that might otherwise remain invisible. Unlike Data Theatre's superficial trend analysis, systematic signal pairing helps validate future patterns through multiple independent indicators:

• Scientific Research + Regulatory Trends
• Speculative Fiction + Technology Roadmaps
• Demographic Shifts + Infrastructure Planning
• Climate Projections + Resource Availability

3. Genesis: Activating Future-Ready Intelligence

While Data Theatre often ends with static "future trend reports" that don't influence decisions, the Scanner's Genesis phase ensures future insights actively shape strategic thinking and planning. Building on the Sensegiving Spectrum framework introduced in Part 2, this systematic approach ensures future insights reach the right stakeholders at the right time in the right format.

The Scanner function adapts the spectrum's three delivery modes specifically for future-oriented communication:

Three Core Delivery Modes for Future Intelligence

4. AI: Augmenting Your Future Vision

While Data Theatre often uses AI as a buzzword, the Scanner function implements AI capabilities systematically across all three phases of the intelligence cycle. These AI enhancements specifically focus on exploring and validating potential futures to build strategic foresight.

From the Appstore, The Kaleidoscope: Exploring Multiple Future Realities.

The Kaleidoscope is a specialized application for your Scanner function that changes how organizations explore and interact with multiple potential futures. This tool helps teams visualize how the same forces, trends, and variables can combine to create different future states, just as a physical kaleidoscope creates beautiful patterns using the same set of elements arranged differently.

Unlike traditional scenario planning tools that present static futures, the Kaleidoscope creates an interactive environment where teams can actively reconfigure variables and immediately see how different combinations might reshape futures.

Key Components:

• Reality Facets: Interactive visualization of how the same elements generate different future states
• Pattern Reconfiguration: Flexible tools to modify variable relationships and significance
• Future Shifting: Real-time visualization of how changes in assumptions alter outcomes
• Stability Testing: Analysis of which elements stay the same across multiple configurations
• Variable Sensitivity: Measurement of factors influencing future states

Example in Action: A renewable energy company uses Kaleidoscope to explore how the same variables: government policies, technology adoption rates, consumer behaviors, and infrastructure investments could create different energy futures. By adjusting the relationships between these elements, they identify three distinct but plausible future states. This helps them develop a portfolio of strategic options that maintain value across multiple scenarios, rather than betting on a single future prediction.

The Kaleidoscope complements other Scanner tools by showing how small changes to existing variables can create different futures. It helps organizations develop flexible and resilient strategies for long-term success.

Your Next Steps: Building a Scanner Action Plan

Ready to enhance your Scanner capabilities? Here's a 90-day action plan:

Days 1-15: Scope Definition and Initial Exploration

• Define priority domains and timeframes for future exploration
• Identify key stakeholders and potential team members
• Gather initial source materials and perspectives
• Define high-level critical uncertainties

Days 16-30: Scenario Framework Development

• Select core uncertainties for initial scenario development
• Create a preliminary scenario framework or matrix
• Develop basic narrative descriptions for each scenario
• Identify initial strategic implications

Days 31-60: Method and Process Implementation

• Design and implement trend triangulation processes
• Develop strategy testing frameworks and methodologies
• Create early warning systems for key scenarios
• Establish regular review and update protocols

Days 61-90: Strategic Integration

• Connect scenario insights to strategic planning processes
• Develop capability gap analyses based on scenarios
• Create strategic option portfolios informed by multiple futures
• Establish mechanisms for ongoing learning and adaptation

Final Thoughts: The Strategic Advantage of Total Awareness

In today's complex and fast-evolving world, organizations can't afford to focus solely on current operations, emerging trends, or future possibilities. They need awareness across all three time horizons.

InsightOS provides the framework for complete awareness. By integrating the Monitor, Radar, and Scanner functions, organizations can navigate the present while preparing for the future, identifying opportunities and threats at every stage.

This integrated approach not only improves decision-making but also creates a strategic advantage.

Organizations with a well-developed InsightOS can:

• Move Faster: They identify changes sooner and comprehend them more thoroughly
• Act More Confidently: Their decisions are guided by thorough knowledge
• Adapt More Effectively: They anticipate shifts before they happen
• Innovate More Successfully: They identify missed untapped opportunities.
• Build Greater Resilience: Their strategies operate across multiple possible futures.

The future belongs to organizations that can navigate complexity with clarity. These organizations will have developed the intelligence architecture to see clearly in all directions and across all time horizons.

As you build your InsightOS, remember this isn't just about tools or processes. It's about creating a different relationship with change, that embraces uncertainty as an opportunity rather than a threat.

In a world of accelerating change, the greatest competitive advantage is strategic clarity. InsightOS is how you create it.

Your Complete InsightOS Implementation Guide

Ready to implement your full InsightOS? Here's a comprehensive 6-month roadmap:

Month 1: Assessment and Foundation

• Audit current capabilities across all three time horizons
• Define strategic priorities and intelligence needs
• Select initial focus areas for implementation
• Build stakeholder alignment and secure resources

Month 2: Monitor Function Implementation

• Implement core Monitor data feeds and dashboards
• Establish regular intelligence review processes
• Create initial KPI and anomaly detection systems
• Build stakeholder feedback mechanisms

Month 3: Radar Function Development

• Implement signal scanning and collection systems
• Develop pattern recognition frameworks
• Create emerging trend identification processes
• Establish regular signal sensemaking sessions

Month 4: Scanner Function Creation

• Develop initial scenario frameworks
• Implement trend triangulation processes
• Create strategic implications analysis methods
• Establish regular future exploration sessions

Month 5: Integration and Enhancement

• Build connections between time horizons
• Implement cross-horizon review processes
• Develop integrated delivery systems
• Enhance capabilities with AI augmentation

Month 6: Embedding and Scaling

• Connect intelligence to strategic planning processes
• Develop measurement and improvement frameworks
• Scale capabilities across the organization
• Establish continuous learning and adaptation mechanisms

With this roadmap, you'll be well on your way to building a comprehensive strategic intelligence system one that provides complete awareness across all time horizons and a sustainable strategic advantage in an uncertain world.

Remember: The InsightOS isn't just a tool or a process, it's a new way of thinking about strategic intelligence. It's about building your organization's capacity to see clearly in all directions: the present, the emerging, and the possible futures ahead.

A InsightOS is a must-have for every future-enabled company.

Market Intelligence

The Radar: Detecting emerging signals

New - Part 4

Tino Klaehne

on Nov 21, 2025

Introduction to the Radar

We have established the Monitor function for tracking known variables. Now we face a different challenge: detecting emerging signals before they become obvious. Organizations move beyond monitoring established metrics to actively search for weak signals of change. This marks the second step in building true strategic awareness.

The Radar function serves as the second layer of your InsightsOS, transforming faint signals into actionable intelligence. While Data Theatre claims to track "emerging trends" through basic scanning and cherry-picked examples, the Radar implements systematic signal detection and pattern recognition that reveals strategic opportunities.

Understanding the Radar function

Think of the Radar as your organization's early warning system. But it does more than just alert. It actively:

• Transforms "unknown unknowns" into "known unknowns"
• Validates emerging patterns through systematic signal triangulation
• Identifies where new momentum is building
• Creates actionable awareness of emerging opportunities before they become clear to everyone

The Radar implements all three phases of the Strategic Intelligence Cycle, unlike Data Theatre's shallow trend tracking:

• Analysis: Systematic scanning for weak signals
• Synthesis: Recognizing patterns and validating signals
• Genesis: Transforming early awareness into strategic advantage

The Radar functions at the boundary of your organization's awareness, searching for weak signals, emerging patterns, and early indicators that could become important in the near future, while the Monitor handles established metrics and known variables.

Core questions the Radar addresses

The Radar addresses questions such as:

• What emerging technologies are just beyond the mainstream?
• Which startups could disrupt our industry?
• What subtle shifts in consumer behavior are emerging?
• Where will new competitors probably emerge?
• What business models are becoming popular in related industries?
• Which trends are accelerating and which are stalling?

1. Analysis: Detecting tomorrow's signals today

While Data Theatre claims to track emerging trends through ad-hoc scanning and selective observation, the Radar's Analysis phase implements systematic signal detection across multiple horizons. These feeds are organized to detect weak signals before they become obvious trends, building on the Indicator Stack framework from Part 2.

Radar feeds focus on early indicators and emerging patterns, unlike Monitor feeds that track known metrics. They combine leading and lagging indicators to validate signal strength, applying the temporal intelligence balance principle from our core framework.

Key data feeds for the NEW horizon include:

2. Synthesis: Making sense of emerging patterns

While Data Theatre often jumps from individual signals directly to claimed "trends," true synthesis in the Radar function requires systematic pattern recognition and validation. Building on the Triangulation Matrix framework introduced in Part 2, the synthesis phase transforms individual signals into validated patterns through deliberate correlation and cross-validation.

Signal pairing and pattern validation

Signal pairing is particularly valuable in the Radar function, where individual weak signals can be difficult to interpret without context.

Unlike Data Theatre's cherry-picked correlations, systematic signal pairing helps validate emerging patterns through multiple independent indicators:

Pattern recognition and validation tools

Building on these signal pairs, the Radar function implements the Triangulation Matrix framework to validate emerging patterns across three key dimensions. Unlike Data Theatre's superficial trend spotting, this systematic approach ensures patterns are validated through multiple perspectives and methodologies:

Pattern validation through triangulation

The Radar function implements systematic validation frameworks across all three synthesis dimensions, ensuring patterns are thoroughly verified before informing strategy:

3. Genesis: Activating strategic early warning

The Genesis phase implements the Sensegiving Spectrum framework to transform emerging signals into strategic action. Unlike Data Theatre's static trend reports, this systematic approach ensures early warnings reach the right stakeholders at the right time in the right format. The Radar function adapts the spectrum's three delivery modes specifically for emerging pattern communication:

Three Core Delivery Modes for Emerging Patterns

Building on the Sensegiving Spectrum introduced in Part 2, each delivery mode serves a specific purpose in pattern communication:

4. AI: Amplifying weak signal detection

While Data Theatre often uses AI as a buzzword, the Radar function implements AI capabilities systematically across all three phases of the intelligence cycle. These AI enhancements specifically focus on detecting and validating emerging patterns before they become obvious to everyone.

From the Appstore…The TrendAccelerometer: Measuring innovation velocity

One of the most powerful specialized applications for your Radar function is the Trend Accelerometer, a tool that measures not just what's emerging, but how fast it's gaining momentum.

Just as a physical accelerometer measures the rate of change in movement, the TrendAccelerometer tracks the speed at which trends are accelerating or decelerating. This helps organizations distinguish between fleeting fads and true momentum-building shifts.

Key components:

• Velocity tracking: Measures trend acceleration across multiple indicators
• Signal strength indicators: Assesses the robustness of signals supporting each trend
• Momentum forecasting: Projects potential future trajectory based on current acceleration
• Friction detection: Identifies barriers that could slow trend adoption
• Comparative acceleration: Compares velocity across multiple trends simultaneously

Together, these apps form an ecosystem of intelligence tools that can be mixed and matched based on your organization's specific needs and strategic priorities.

Your Next Steps: Building a Radar action plan

Ready to enhance your Radar capabilities? Here's a 90-day action plan:

Days 1-15: Scope definition and resource alignment

• Define priority domains for signal detection
• Identify key stakeholders and potential team members
• Inventory existing signal sources and detection activities
• Establish initial success criteria and KPIs

Days 16-30: Signal collection design

• Select initial data sources and monitoring approaches
• Develop signal collection and aggregation processes
• Create initial categorization and organization frameworks
• Set up a signal repository or database

Days 31-60: Pattern recognition development

• Implement signal clustering methodologies
• Develop initial trend acceleration metrics
• Create visualization tools for emerging patterns
• Design validation protocols and thresholds

Days 61-90: Sensemaking and integration

• Establish regular signal review and sensemaking sessions
• Connect pattern detection to strategic conversations
• Create feedback loops for signal relevance
• Develop initial measurement approaches for effectiveness

In our next article, we'll explore the NEXT horizon and how the Scanner function helps organizations map potential futures and prepare for longer-term opportunities and disruptions.

Threat Intelligence

Prompt Engineering: Newsletter template for real-time phishing trends

Keep your users informed of evolving threats with this AI prompt

Andrew Castro

on Nov 19, 2025

People, not just technology, are often the first line of defense against cyber threats. Even the most advanced security tools can’t stop an employee from clicking a malicious link or reusing a weak password. Regular awareness efforts, such as newsletters, help keep security top of mind and turn abstract risks into relatable scenarios that employees can understand and act on.

Building engaging security awareness content can be tedious work for cybersecurity teams charged with identifying and defending against the latest threats.

That's why we built an AI Prompt for a security awareness report that does the heavy lifting for you.

Introducing the AI-powered security awareness newsletter

This prompt generates a ready-to-send phishing awareness newsletter for your organization.

The newsletter will include:

• A catchy headline explaining current phishing risks
• A summary of this week's phishing trends, 3–5 practical tips employees can act on immediately
• A focused "education topic of the week" with actionable guidance
• A closing that ties security awareness to both individual and organizational protection

Everything's formatted for readability, designed and written in common non technical language, so it actually resonates.

Why this matters

Phishing remains one of the most common entry points for cyber attacks. Turning intelligence about phishing campaigns and social engineering tactics into accessible awareness content helps employees build intuition for spotting suspicious activity.

Threats evolve year-round, and so should our awareness. By pairing Feedly's AI Feeds with this prompt, awareness teams can scale their communications, keep security top-of-mind, and strengthen the organization's overall resilience every week of the year.

AI Overview prompt

<Role> Act as a Security Awareness Team. <Role> 

<Task> 
Create a Phishing Awareness Newsletter designed for a non-technical, general audience. Write at a common reading level and keep it clear, concise, and engaging for busy readers.
<Task> 

<Guidelines> 
- Headline & Intro: Catchy headline and a short introduction (2–3 sentences) explaining why phishing is a current risk.
- Phishing Trends: Summarize common phishing themes observed this week (e.g., fake package delivery, QR code scams, MFA fatigue). Use short paragraphs or bullet points.
- User Tips: Provide 3–5 practical security awareness tips users can apply immediately.
- Weekly Focus: Highlight one “education topic of the week” (e.g., QR code phishing) with a short explanation and how to stay safe.
- Closing: End with a friendly reminder that staying alert protects both the individual and the organization.
<Guidelines> 

<Formatting> 
Keep formatting consistent.use headers, bullets, and short sections for readability. Keep the newsletter professional and refrain from emojis.
<Formatting>

Pairing the prompt with a Feedly AI Feed

To get the most value from this prompt, pair it with a Feedly AI Feed that tracks current phishing and scam intelligence. This ensures your newsletters reflect the latest threats and tactics your employees might encounter.

Here's an example AI Feed configuration that captures phishing trends:

This feed monitors emerging phishing campaigns, new social engineering tactics, and fraud schemes as they're reported across security blogs, advisories, and threat intelligence sources. By feeding this intelligence directly into the prompt, you can generate newsletters that address the specific threats employees are most likely to face.

When used inside Feedly's Automated Newsletters feature

Once you select your AI Feed in Feedly's Automated Newsletters feature, choose your preferred cadence and your newsletters will automatically deliver the latest content from your AI Feed on schedule.

Result

When used in a regular LLM

This prompt can also work with another LLM; however, we suggest you provide the right context and information to ensure the LLM delivers the best possible result. The quality of your input and sources will determine the quality of your output.

The real opportunity

Security awareness can have a profound effect on your security posture. Fewer malicious links clicked, better password security, faster software updates, and better employee reporting of incidents.

If you're charged with ensuring your users' security awareness and looking to elevate your program, this template is your chance to deliver smarter, faster, more relevant education without adding to your already demanding workload.

Try it yourself: Use this prompt with your Feedly AI Feeds tracking phishing and scam intelligence to generate weekly awareness newsletters that keep your organization informed and vigilant.

Try Feedly Threat Intelligence

Try Feedly Automated Newsletters and streamline the generation of CTI reports.

Start Free Trial

Market Intelligence

The Monitor: Tracking the known present

Now - Part 3

Tino Klaehne

on Nov 14, 2025

Introduction

Having established why organizations need to move beyond "Data Theatre". We now begin implementing the InsightsOS framework with its foundational time horizon: NOW. This is where organizations break free from Data Theatre and begin building true strategic awareness. While Data Theatre collects meaningless metrics, the Monitor function transforms raw data into actual intelligence, marking the critical first step from performing research to driving decisions. This is where momentum-based innovation starts—not with speculation about the future, but with systematic, action-oriented awareness of the present.

The Monitor function is the foundation of your strategic intelligence system. Before detecting emerging patterns (Radar) or exploring possible futures (Scanner), you must master seeing what's happening right now, beyond superficial metrics and impressive-looking dashboards of Data Theatre to build genuine strategic awareness. This capability provides the signal quality and pattern recognition foundation for other horizons.

Understanding the monitor function

The Monitor function serves as the first layer of your InsightsOS, transforming raw data into awareness and action. This isn't about creating more advanced dashboards; it's about fundamentally changing how your organization processes and acts on intelligence.

Think of Monitor as your organization's central nervous system. But it does more than just react. It actively:

• Detects significant patterns in market movements, not just gathers data points.
• Validates or challenges strategic assumptions in real-time, instead of confirming existing biases.
• Identifies where momentum is increasing or decreasing, moving beyond static snapshots.
• Creates practical awareness of the current situation, not just impressive reports.

Unlike the speculative Radar and Scanner functions we'll explore later, Monitor deals primarily with concrete, measurable realities. But its power lies not in passive observation, but in active sense-making, turning current signals into strategic advantage.

Core questions the monitor answers

The Monitor addresses questions such as:

• How are market dynamics shifting?
• What are competitors doing at the moment?
• Are we achieving our strategic goals?
• Where are we losing or gaining ground?
• What is happening with key customers and partners?
• How are changes in regulations affecting our operations?

1. Analysis: Monitoring the market's vital signs

Building on the Indicator Stack framework from Part 2, these are the raw inputs for your Monitor system. They should be diverse, reliable, and regularly updated.

Key data feeds for the NOW horizon include:

Market performance feeds

• Market share data and trends
• Industry growth rates and forecasts
• Customer spending patterns
• Channel performance metrics
• Geographic performance variations

Voice of Customer Feeds

• Customer feedback and support tickets
• Social media mentions and sentiment
• Review site activity and ratings.
• Net Promoter Score (NPS) trends
• Customer service performance metrics

Financial Performance Feeds

• Revenue and margin tracking
• Budget variance analysis
• Cash flow and working capital metrics
• Cost structure and efficiency measures
• Return on investment (ROI) for key initiatives

Regulatory and Compliance Feeds

• Regulatory changes and updates
• Compliance metrics and violations
• Industry standard developments
• Legal and political developments
• Risk assessment metrics

2. Synthesis: Understanding today's market signals

The synthesis phase marks an important shift from Data Theatre's superficial analysis, as it applies the Triangulation Matrix framework from Part 2.

While Data Theatre often stops at impressive visualizations that obscure underlying realities, the Monitor's synthesis phase activates all three dimensions of the matrix:

• Horizontal synthesis: Linking patterns across market segments and competitor activities
• Vertical synthesis: Examining the depth and strength of current market dynamics
• Temporal synthesis: Monitoring pattern stability and evolution in real-time

This structured approach transforms raw data into meaningful insights through systematic pattern recognition and validation. It moves beyond the selective interpretation and confirmation bias common in Data Theatre. The Monitor function adapts the Triangulation Matrix for known variables and current conditions, using multiple signal pairs to build confidence in insights.

Pattern recognition tools

Pattern recognition in the Monitor function starts with signal pairing, following the Triangulation Matrix's validation principles. This practice contrasts Data Theatre's cherry-picked metrics. This approach implements the matrix's core methodology of using multiple data points, methods, and perspectives to validate patterns.

Instead of selecting confirming data, signal pairing combines different data points across all three synthesis dimensions to validate insights and create nuanced understanding.

• Corporate buying signals + Industry narrative: Revealing gaps between messaging and behavior
• Voice of customer + Support ticket volume: Building complete pictures of customer experience
• Price changes + Competitor reactions: Understanding competitive dynamics
• Market share shifts + Marketing campaign timing: Validating campaign effectiveness
• Website traffic + Sales conversion: Optimizing channel performance

These pairs form the foundation for more advanced pattern recognition using:

Competitive benchmarking tools

• Feature comparison matrices
• Price position analysis
• Comparisons of messaging and positioning
• Performance benchmarking calculators
• Competitive response analyzers

Market share analytics

• Share of voice calculators.
• Share of wallet estimators.
• Segment penetration analysis.
• Share trend analyzers.
• Relative market position visualizers.

Performance variance analysis

• KPI variance calculators
• Plan vs. actual comparators
• Trend deviation detectors
• Anomaly highlighters
• Statistical significance testers

Voice of customer analysis

• Sentiment analysis tools
• Feedback categorization systems
• Issue prioritization frameworks
• Customer journey mappers
• Loyalty predictors

Price monitoring tools

• Competitive price trackers
• Discount and promotion analyzers
• Price elasticity calculators
• Value perception metrics
• Price optimization recommenders

3. Genesis: Activating real-time strategic intelligence

The Genesis phase is where organizations move beyond Data Theatre by turning insights into action. While Data Theatre concludes with impressive presentations that don't affect decisions, the Monitor's Genesis phase ensures intelligence actively shapes strategy and operations. This occurs through three delivery modes: Push Intelligence (proactive delivery), Pull Intelligence (on-demand access), and Embedded Intelligence (workflow integration). For the NOW horizon, this creates a comprehensive delivery system that ensures intelligence reaches the right stakeholders at the right time in the right format, driving decisions and actions.

Push Intelligence

• Proactive alerts and notifications that demand action, not just attention.
• Scheduled intelligence briefings focused on decisions, not just data.
• Pattern-triggered updates with clear response protocols.

Pull Intelligence

• Self-service intelligence portals
• Interactive data exploration tools
• On-demand report generation
• Searchable insight repositories

Embedded Intelligence

• Workflow-integrated insights
• Context-aware recommendations
• Decision support systems
• Process-specific intelligence feeds

4. AI: Augmenting your market vision

AI can significantly augment your Monitor capabilities, automating routine tasks and surfacing insights that might otherwise remain hidden.

Key AI enhancements for the NOW horizon include:

News monitoring and summarization agents

• Automated competitive news scanning
• Intelligent article summarization
• Relevance filtering and prioritization
• Entity and relationship extraction
• Automatic tagging and categorization

Anomaly detection systems

• Pattern deviation identifiers
• Outlier detection algorithms
• Early warning systems
• Automated root cause analysis
• Prediction-based anomaly detection

Earnings call and document analysis

• Automated transcript processing
• Sentiment and key message extraction
• Quarter-over-quarter comparison
• Strategic shift detection
• Commitment tracking

Synthetic intelligence briefs

• Daily Business Status briefs combining operational KPIs and market conditions
• Weekly Performance Reviews with variance analysis and emerging issues
• Monthly Market Snapshots tracking competitive dynamics and customer trends

Intelligence chatbots

For the NOW horizon, MCP-enabled intelligence chatbots excel at providing quick access to current status information:

• "What's our current market share in the southeast region compared to last quarter?
• "Summarize the key points from our top competitor's earnings call yesterday"
• "Show me all customer complaints about our new product feature in the past 30 days"
• "What regulatory changes have been announced this month that affect our industry?"

From the intelligence AppStore: PressureGauge: Detecting disruption breakthroughs

The PressureGauge represents the critical transition point between Monitor and Radar functions. While most Monitor tools track visible data, the PressureGauge helps you detect potential significant change due to current conditions.

The PressureGauge detects stress areas from regulation, competition, customer shifts, or technological change. This helps organizations anticipate potential issues in existing systems. You can identify where to direct your Radar function for emerging signals.

Key components:

• Pressure point detection: Identifies areas under several stress factors
• Disruption mapping: Shows pressure points across industry segments
• Release valve analysis: Identifies likely initial disruption
• Force multiplier identification: Highlights factors increasing pressure in specific areas
• Pressure forecasting: Projects how pressure may change over time

This app illustrates how the InsightOS AppStore allows for advanced monitoring using modular, purpose-built tools. In Parts 4 and 5, we will examine more apps designed for the NEW and NEXT horizons.

Your next steps: Building a monitoring action plan

Ready to enhance your Monitor capabilities? Here's a 90-day action plan:

Days 1-15: Assessment and prioritization

• Inventory current monitoring tools and approaches
• Interview key stakeholders about information needs and gaps
• Identify your most critical monitoring priorities
• Select one high-impact area for your initial focus

Days 16-30: Design and resource allocation

• Design your first integrated Monitor dashboard or report
• Identify data sources and integration requirements
• Secure necessary resources and stakeholder buy-in
• Establish clear ownership and responsibilities

Days 31-60: Implementation and testing

• Build your initial Monitor solution
• Train users and gather feedback
• Refine metrics and presentation based on input
• Establish regular review rhythms and protocols

Days 61-90: Expansion and enhancement

• Evaluate initial results and document impact
• Identify next-priority Monitor capabilities
• Begin integrating AI enhancements where valuable
• Connect your Monitor function to emerging Radar capabilities

In our next article, we'll explore the NEW horizon and how the Radar function helps organizations detect emerging signals and opportunities before they become obvious to everyone else.

Market Intelligence

Startup Innovation Radar: A real-time startup database

Discover, track and compare startups in any industry

Jay Feyerabend

on Nov 06, 2025

15-Second summary

Monitoring all emerging startups in your industry is vital, but current methodologies have flaws. Organic discovery is time-consuming and incomplete, while paid databases provide outdated metrics and rigid search options, restricting your ability to target specific focus areas.

That is why we created the Startup Innovation Radar, so you can:

• Discover startups in any specific industry, product category or niche with natural language search.
• Collect comprehensive real-time information on all startups on a specific market, including those who haven't raised funds yet.
• Compare and prioritize disruptive startups with leading indicators, such as strategic moves, recent awards, acceleration program participation and technological breakthroughs.
• Build a dynamic database of players and their activity with metadata tailored to your needs, updated in real time.
• Share critical updates about tech innovations startups with your organization as PDFs, CSV Files or with Feedly's automated newsletters.

Stay ahead in your industry with the Startup Innovation Radar, providing near real-time discovery and analysis of startups, even pre-funding. Effortlessly track key metrics, compare strategic moves, and share innovation insights with your team—all in one dynamic, customizable platform.

Discover startups across industry, product category or niche with natural language search

Other tools are limited by rigid, predefined industries, which don’t successfully capture the complex ecosystems our customers search for signal. With the Startup Innovation Radar, you can search the way you think easily searching across industries and sectors.

Simply ask in natural language for "Data Center Cooling" or "Agentic AI in Ecommerce" and get immediate, relevant results. This intuitive approach allows you to drill down into any specific product category or emerging niche, ensuring you find the precise relevant early signals.

Collect comprehensive real-time information on all startups within a market

Paid databases often only track companies after a major funding round, leaving you blind to the newest, most agile players. The Startup Innovation Radar provides comprehensive, real-time information on all startups in a specific market, including those who haven't raised any funds.

By tracking signals from across the web, you can discover bootstrapped innovators and pre-seed ventures the moment they emerge, giving you a complete and timely view of the entire competitive landscape.

Compare and prioritize disruptive startups with leading indicators

Funding is just part of the story. To truly understand a startup's potential, you need to look at forward-looking signals. The Startup Innovation Radar helps you move beyond outdated metrics and prioritize the most disruptive companies using true leading indicators. You can effortlessly compare startups based on what really matters:

• Strategic moves like new partnerships
• Recent industry awards
• Participation in top tier acceleration programs
• Significant technological breakthroughs

Along with these indicators indicators, compare similar startups to get a more complete view of the market and the potential disruptors.

Build a dynamic database of startups and their activity

The Startup Innovation Radar allows you to save your custom searches and build a comprehensive list of startups tailored to your niche. You can return to your saved lists to track their activity in real-time, and create a single source of truth that is automatically updated as news breaks. With our export to CSV feature, you can easily feed all of the information into your pre-existing database.

Share critical updates about tech innovations startups with your organization

The Startup Innovation Radar is built for collaboration between teams, making it simple to share critical updates about tech innovations and emerging startups with your entire organization. Export your findings and custom reports as clean CSV files for deep analysis. Even better, leverage Feedly's automated newsletters to push critical alerts and summaries directly to your team's inbox, keeping everyone informed and aligned with minimal effort.

In short...

With the Startup Innovation Radar, you can stay ahead of your industry with near real-time discovery and analysis of startups. Effortlessly track key metrics, compare strategic moves, and share innovation insights with your team—all in one dynamic, customizable platform.

Discover your next disruptor

Track and compare startups in any industry with Feedly Market Intelligence’s new Startup Innovation Radar.

Start Free Trial

FAQs

Market Intelligence

The InsightOS architecture

How- Part 2

Tino Klaehne

on Nov 05, 2025

Introduction: Transitioning from ad-hoc research to a systematic InsightOS

In Part 1, we established why organizations need an InsightOS—a systematic approach to intelligence for modern business environments. Now we will explore how to build one, outlining an architecture that transforms theoretical need into practical capability.

This architecture isn't just another framework. It's the operating system that enables systematic intelligence work across all time horizons. Just as your computer's OS coordinates basic input and output to complex applications, the InsightOS architecture manages all aspects of strategic intelligence, from daily monitoring to long-range foresight.

Many organizations still treat research as isolated projects, which leads to fragmented insights and missed opportunities. The InsightOS architecture solves this by creating a unified system that is:

• Always on: Continuously processing information
• Modular: Easily adjusted as needs change
• Scalable: Expanding alongside your organization
• Integrated: Connecting insights across different time horizons

The InsightOS architecture reflects the Strategic Intelligence Cycle:

• Analysis phase: Data Feeds - Systematic signal collection and processing
• Synthesis phase: Intelligence Tools - Identifying patterns and understanding data
• Genesis phase: Delivery Systems - Creating value and enabling action

Each time horizon requires different configurations of feeds, tools, and delivery systems, yet all operate on the same fundamental architecture. Think of it as running different applications on the same operating system, optimized for specific tasks while sharing core capabilities.

This three-phase architecture enables the specific capabilities we'll explore in Parts 3-5 of the blog series.

The operating system approach

The InsightOS architecture functions on three basic levels, crucial for turning intelligence capabilities into strategic advantage:

1. Core System Layer

• Manages basic input and output operations
• Manages data storage and retrieval
• Controls access and permissions

2. Intelligence Processing Layer

• Orchestrates analysis, synthesis, and creation
• Manages workflows and data quality
• Enables pattern recognition and sense-making

3. Application Layer

• Hosts specialized intelligence applications
• Supports different time horizons (NOW/NEW/NEXT)
• Enables customization for specific needs

Like your computer's operating system, these foundational layers handle complex operations invisibly. You don't need to understand how they work; they just need to work, allowing you to focus on using the applications that matter to you instead of worrying about how they communicate with each other.

Think of it like your smartphone: you don't care how the operating system works—you just want to download apps and use them. Similarly, InsightOS provides a dependable foundation where you can install and run the intelligence tools you need, when you need them.

The InsightOS isn't about prescribing specific tools or methods. It's about creating an architecture that allows you to install, integrate, and orchestrate the right intelligence mix for your specific needs, all while adapting to inevitable change.

The Intelligence AppStore: Your intelligence ecosystem

The Intelligence AppStore transforms InsightOS's foundational architecture into a specialized marketplace where system capabilities are packaged into practical applications for your intelligence needs.

As a carefully selected ecosystem built on the core architecture, every application works together. InsightOS applications exchange insights, combine analyses, and build on each other's outputs.

The Intelligence AppStore organizes intelligence applications along two key dimensions that map to your strategic needs:

Time Horizon

NOW (Monitor): Applications for tracking known variables

NEW (Radar): Tools for detecting emerging patterns

NEXT (Scanner): Systems for exploring possible futures

Intelligence Phase

Analysis (Feeds): Applications that gather and process data

Synthesis (Tools): Applications that recognize patterns and generate insights

Genesis (Delivery): Applications that create value and enable action

Each time horizon integrates with the complete intelligence cycle. These applications collaborate to transform raw data into strategic value.

While the Intelligence AppStore offers flexibility in tool selection, three core components form the essential foundation of any InsightOS implementation:

1. The Indicator Stack: Your systematic framework for data collection and analysis
2. The Triangulation Matrix: Your engine for pattern recognition and validation
3. The Sensegiving Spectrum: Your system for transforming insights into action

This modular approach enables scalability: You can begin with key applications and expand as needed. New features are incorporated without interrupting current workflows. With unified architecture, insights transfer smoothly between applications and time horizons.

In the following sections, we'll explore the core applications that form the foundation of any InsightOS implementation: the Indicator Stack for Analysis, the Triangulation Matrix for Synthesis, and the Sensegiving Spectrum for Genesis.

The Indicator Stack: A framework for structured analysis

The Indicator Stack is the foundational framework for data collection and analysis in your InsightOS. It provides an architectural approach to building a comprehensive intelligence foundation across all time horizons instead of prescribing specific data sources.

As a dynamic system, it evolves with new data sources and capabilities, adapting to changing strategic priorities while scaling with organizational maturity and emerging research needs.

The framework's comprehensive coverage across signal types prevents over-reliance on familiar sources, reducing confirmation bias through cross-validation of insights to create a balanced and objective intelligence foundation that remains effective as your organization and the competitive landscape change.

Core Framework Principles:

Temporal Intelligence Balance The stack is fundamentally organized around two types of indicators that bridge different time horizons: NOW (Primarily lagging indicators), NEW (Mix of lagging and leading indicators) and NEXT (Primarily leading indicators)

Lagging Indicators (NOW-focused)

• Measure what has happened
• Confirm established patterns
• Track current performance
• Validate known dynamics

Examples: Revenue figures, market share data, customer satisfaction scores

Leading Indicators (NEXT-oriented)

• Signal what might happen
• Predict emerging patterns
• Anticipate future developments
• Identify potential shifts

Examples: R&D investments, patent applications, scientific publications

Signal Architecture

The stack organizes signals into four fundamental layers:

Implementation Considerations

The Indicator Stack isn't a fixed template—it's a living framework that each organization must configure based on their:

• Intelligence maturity level
• Budget constraints
• Innovation risk profile
• Strategic research needs

Organizations must balance several factors when building their stack:

• Commercial vs. custom data sources
• Premium vs. basic data access
• Build vs. buy decisions
• Coverage vs. depth tradeoffs

This framework serves as the Analysis foundation of your InsightOS, enabling the systematic data collection that powers both pattern recognition (explored in the Triangulation Matrix) and strategic delivery (covered in Sensegiving Spectrum).

In Parts 3-5, we'll explore specific implementations of the Indicator Stack across different time horizons NOW, NEW, NEXT.

The Triangulation Matrix: A framework for pattern recognition

The Triangulation Matrix acts as your InsightOS's engine for Synthesis and sense-making. The Indicator Stack offers structured data collection, while the Triangulation Matrix converts raw intelligence into meaningful patterns and actionable insights. It serves as the main tool for implementing momentum-based innovation by systematically measuring and tracking the forces that give certain patterns more momentum.

Triangulation uses multiple data points, methods, and perspectives to validate patterns, like ancient navigators used multiple reference points to determine their location.

Validation occurs through two primary methods: source triangulation (combining quantitative metrics, qualitative insights, and expert perspectives) and methodological triangulation (cross-referencing multiple analytical frameworks). Triangulation increases confidence in pattern recognition while minimizing bias and false positives by combining these methods across different evidence types.

Synthesis Dimensions

The Triangulation Matrix is built on three fundamental dimensions that allow for thorough pattern recognition and validation:

Pattern validation requirements vary across time horizons:

Implementation Considerations

The Triangulation Matrix provides a strong synthesis framework, but its effective implementation requires careful configuration based on your organization's context and capabilities. Consider these key factors:

• Strategic Context: The matrix must align with your organization's pattern recognition priorities, time horizon focus, and risk tolerance. The speed of decision-making and your team's analytical capabilities will greatly affect the matrix's configuration and utilization.
• Technical Configuration: The matrix implementation requires careful consideration of pattern recognition methods, validation thresholds for pattern significance, integration approaches between data sources, and visualization techniques to make complex patterns understandable to stakeholders.
• Organizational Integration: Successful implementation depends on team capabilities and training, smooth workflow integration with existing processes, active stakeholder engagement, and established review and refinement processes to improve pattern recognition capabilities.

This framework serves as the Synthesis engine of your InsightOS. It transforms structured data from your Indicator Stack into strategic insights that drive action through your Delivery Systems.

In Parts 3-5, we'll explore detailed implementations of the Triangulation Matrix across different time horizons.

Sensegiving Spectrum: From insights to impact

With patterns validated through triangulation, the next critical challenge is turning these insights into action. Even the most rigorous analysis creates no value until it influences decisions and behavior. This is where the Sensegiving Spectrum comes in—the final component that transforms validated intelligence into organizational impact.

Three Core Delivery Modes

Push Intelligence

Proactively delivers intelligence to users through automated alerts, scheduled reports, and system-triggered notifications, ensuring critical insights reach stakeholders without manual intervention.

• System-initiated delivery
• Scheduled updates and alerts
• Triggered by pattern detection
• Proactive distribution

Pull Intelligence

Enables users to actively seek and retrieve intelligence on demand through searchable repositories and interactive platforms, supporting deep-dive analysis and exploratory research.

• User-initiated access
• On-demand queries
• Self-service platforms
• Interactive exploration

Embedded Intelligence

Seamlessly integrates intelligence directly into existing workflows and tools, making insights immediately accessible within the context where decisions are made.

• Integrated into workflows
• Connected to existing tools
• Context-aware delivery
• Decision support systems

Key Design Principles

Format Flexibility

• Static to interactive
• Template to synthetic
• Complete context to focused updates

Contextual Awareness

• User role and knowledge
• Decision timing
• Strategic relevance

Implementation Across Time Horizons

Modern delivery systems match the right intelligence to the right person at the right time in the right format, creating an intelligence ecosystem that adapts to how organizations work and make decisions.

The AI Layer: Augmenting the InsightOS architecture

The InsightOS architecture integrates AI capabilities across all three phases (Analysis, Synthesis, Genesis).This isn't just about adding AI features; it's about augmenting research operations.

Traditional apps handle specific tasks within each phase (feeds for Analysis, tools for Synthesis, systems for Genesis). In contrast, AI agents work across boundaries, creating connections and automating workflows. This hybrid approach combines the modularity of apps with the flexible capabilities of AI:

Core Functions of AI in the InsightOS

AI improves each stage of the Strategic Intelligence Cycle while generating new capabilities:

The home screen: Your intelligence hub

Think of your phone's home screen. It's not just a grid of apps – it's a reflection of how you've rejected the factory defaults to create something uniquely yours. Your InsightOS home screen takes this personalization to a new level, freeing your intelligence workflow from the constraints of bloated enterprise suites.

Just as you've carefully chosen which apps deserve precious home screen real estate, your intelligence hub should reflect intentional choices, not vendor assumptions. While enterprise platforms force you to wade through features you'll never use, your custom hub contains only what drives value:

Every tool placement is a strategic decision. Like removing pre-installed bloatware from your phone, you're free to strip away unnecessary features and build exactly what your team needs. This isn't just about convenience – it's about crafting a methodology that fits your organization's unique intelligence requirements.

Smart Placement Drives Adoption:

• Position critical monitoring tools front and center – just as you put your most-used apps on your phone's main screen, not buried in folders
• Create quick-access zones for trend tracking tools, similar to keeping social media within thumb's reach – but designed for your team's actual workflow, not a vendor's assumption of it
• Group deep analysis tools logically, like organizing utility apps in folders – but with the freedom to structure them around your methodology, not predetermined categories

Just as you've rejected your phone's default layout, break free from prescribed intelligence workflows. Create spaces that reflect how your team actually works – whether that's rapid competitor monitoring, deep market analysis, or custom combinations of both. Your layout becomes a statement of independence from one-size-fits-all solutions.

Like a carefully curated home screen, your intelligence hub reveals your true priorities. But unlike rigid enterprise platforms, it adapts as your needs evolve, supporting your methodology instead of forcing you to adopt someone else's.

Smart Management, Like Your Phone:

• Tool Evaluation: Regular cleanup of unnecessary tools, just like removing unused apps from your phone
• Resource Focus: Invest only in data you actually use, avoiding bundled subscriptions that bloat your budget
• Seamless Sharing: Create direct workflows between tools, as intuitive as sharing between your favorite apps
• Layout Evolution: Adjust your workspace as priorities change, not when vendors push updates
• Efficient Performance: Maintain a lean, focused system that serves your needs, not vendor feature lists

Operating principles of InsightOS

A great InsightOS isn't just a collection of tools; it's a strategic operating system. Its effectiveness depends on what's installed, how it's designed, maintained, and experienced.

These principles combine the technical integrity of an OS with the flexibility required for real-world strategy work.

1. Designed for Decision-Making

The primary purpose of the system is to enable better decisions:

• Prioritizes actionable insights over basic data collection.
• Designed to answer "So what?" and "What now?"
• Integrates intelligence directly into strategic workflows.
• Focuses on the speed and quality.

2. Modular, Scalable and Adaptive

Flexibility is key for modern operating systems:

• It follows a plug-and-play logic: tools, feeds, and delivery systems can be swapped or upgraded.
• Avoids vendor lock-in with a flexible architecture.
• Scales with the level of organizational maturity and available resources
• Adapts to changing strategic needs without completely overhauling the system

3. Systematic and Structured

Consistency fosters dependability:

• Intelligence work follows a consistent framework, not random processes.
• Ensures continuity among teams and roles
• Reduces reliance on individual memory or isolated knowledge
• Maintains clear records and procedures

4. Integrated and Multi-Source

No single source tells the complete story:

• Combines qualitative and quantitative inputs.
• Supports triangulation across domains, timeframes, and formats.
• Avoids depending too much on any single signal or tool.
• Creates a combination of different viewpoints

5. Actively Maintained and Audited

Like any operating system, regular updates are critical:

• Subject to regular audits of tools, processes, and signal quality.
• Encourages trying out new sources and delivery formats.
• Responds to feedback from users and decision-makers.
• Evolves based on performance measurements.

6. Created for Adoption and Impact

Value comes from real use:

• Stresses internal communication, onboarding, and ownership.
• Surfaces intelligence in specific contexts, not just through dashboards.
• Regularly reviews home screen placements.
• Measures and improves user engagement.

Building your InsightOS: A practical roadmap

1. Assess Your Current Intelligence Ecosystem (2-4 Weeks)

Start by mapping out your current intelligence capabilities across the three horizons (Monitor, Radar, Scanner). Where are you strong? Where are there gaps? How well do these systems communicate with each other?

Action Items:

• Interview key stakeholders across departments about their intelligence needs and current sources.
• Document existing tools, subscriptions, and processes
• Create a visual map of your current intelligence flows.
• Identify which time horizons (Now, New, Next) are well-covered and which are neglected.

2. Define Your Intelligence Priorities (1-2 Weeks)

Not all organizations need the same intelligence mix. Based on your industry, competitive position, and strategic goals, what intelligence capabilities would create the most value?

Action Items:

• Conduct a strategic mapping session with leadership
• Prioritize intelligence needs based on your current strategic challenges.
• Determine which time horizons need immediate attention.
• Identify key stakeholders for each intelligence area

3. Start Small and Focused (4-6 Weeks)

Rather than trying to build a comprehensive system all at once, begin with a focused use case that delivers clear value.

Action Items:

• Select one high-impact intelligence need to address first.
• Design a pilot implementation with clear success metrics.
• Implement a small-scale version of your InsightOS focused on this need.
• Collect feedback and document lessons learned.

4. Scale Deliberately (Ongoing)

Based on your priorities and the results of your pilot, gradually expand your InsightOS.

Action Items:

• Select the next component to add to your architecture.
• Integrate new tools and data sources
• Train additional users and stakeholders
• Document processes and best practices
• Celebrate and communicate early wins

In the next three articles, we'll dive deeper into the specific components of the NOW, NEW, and NEXT horizons, exploring how each can be implemented in detail. Whether you're just starting your InsightOS journey or looking to enhance your existing capabilities, these frameworks will provide practical guidance for building a comprehensive strategic intelligence system. See the previous blog Part 1- Strategic Intelligence at Speed of Change

Threat Intelligence

Feedly MCP Server: Automate CTI workflows with Claude and the Feedly Threat Graph

Richer threat context. More accurate AI responses.

Shawn Jaques

Dave Johnson

on Nov 04, 2025

Context engineering is the new AI multiplier: output quality is no longer about how you ask, it's what context the AI can access when it answers.

With the new Feedly Threat Graph MCP Server, Claude gets real-time access to enriched articles and threat insights from 10,000+ trusted sources: relationships between 800+ threat actors, 10K+ malware families, 300K+ CVEs, 500K+ IoCs, 800+ techniques and tactics, and 10K+ cyber attacks.

The 16 tools exposed by the Threat Graph MCP server allow Claude to research like a CTI analyst and deliver more accurate and timely responses.

Ask about a ransomware campaign, and Claude correlates threat actors, their TTPs, exploited CVEs, and associated IoCs.

Or use multiple MCP servers to orchestrate end-to-end threat hunt workflows.

Let's walk through four scenarios, from simple queries to complex workflows, that showcase how you can perform more accurate CTI research when connecting Claude to the Feedly Real-Time Threat Graph.

First, what is an MCP Server, and how can they help

An MCP (Model Context Protocol) server is a standardized interface that enables AI assistants to access tools and data sources directly in real-time. The Feedly MCP Server allows Claude AI to pull fresh intelligence directly from Feedly’s Real-Time Threat Graph.

For CTI analysts, this means you can ask Claude CTI research questions, such as "What are the latest TTPs associated with APT29?" and it will fetch current data from the Feedly Threat Graph, rather than relying solely on fragmented web search data. This improved context enables Claude to provide more timely, relevant, and actionable insights.

Claude's reasoning and use of specialized tools shows how it thinks like a CTI analyst: identifying and looking up APT29, extracting relationships, and synthesizing recent campaign intelligence with cited sources.

Demo 1: Tracking active ransomware campaigns

Prompt

What's trending in ransomware attacks this month?

Web search gives Claude and other AI tools a few articles to improve the currency of it’s LLM-trained answer. However, rarely does it give a comprehensive view of current and evolving cyber events. The Feedly MCP Server connects your AI tools directly to our Real-Time Threat Graph, giving you comprehensive, connected intelligence from 10,000+ sources with pre-mapped relationships between actors, campaigns, and vulnerabilities.

Result

When you ask Claude this question with the Feedly MCP Server enabled, it automatically queries our Threat Graph for ransomware activity from the last 30 days. The AI selects and chains multiple tools, pulling trending cyber attacks, filtering by attack type, and identifying the responsible threat actors.

What you get: Specific ransomware trends with attribution, affected sectors, ransom demands, and financial impact. Not fragments from random search results that miss the connections.

Why it matters: More complete and up-to-date context from the Real-Time Threat Graph, rather than a few articles that ranked well in search, helps the AI produce answers that reflect all known relationships and recent activity. The responses are more actionable so you can quickly move from question to action and start protecting your business.

Demo 2: Identifying actively exploited vulnerabilities

Prompt

What are the most dangerous vulnerabilities discovered in the past week that threat actors are already exploiting? For each one, tell me: who's exploiting it, what malware they're using, what industries they're targeting, and if there are any proof-of-concept exploits or Metasploit modules available.

Result

This query triggers complex reasoning. The MCP Server pulls trending vulnerabilities, cross-references them with threat actor activity, identifies associated malware families, and checks for available exploits—all automatically.

What you get: CVEs with active exploitation evidence, specific threat actor attribution, targeted sectors, associated malware families, and exploit availability status.

Why it matters: Instead of manually pivoting between NVD, threat feeds, and campaign reports, you get the full threat context in one query. You immediately know if a CVE is being weaponized, by whom, and against what sectors, so you can prioritize patching based on actual risk to your environment, not just CVSS scores.

Demo 3: Building actionable threat hunts

Prompt

Build me a threat hunt for Scattered Spider based on their last 3 months of activity.

Result

The MCP Server reasons through Scattered Spider's recent campaigns, extracting their current TTPs, infrastructure patterns, and targeting preferences from reported incidents.

What you get:

• Current TTPs mapped to MITRE ATT&CK based on observed activity.
• Detection opportunities tied to their recent Salesforce and identity provider campaigns.
• Queries ready to run in your SIEM.

Why it matters: When investigating Scattered Spider, you need a full operational picture, not search results. The Feedly MCP Server gives you deduplicated intelligence from thousands of sources, temporally organized so you can see how their tactics evolved. You're working with their complete recent activity profile, ready to operationalize.

Demo 4: Multi-tool orchestration for end-to-end workflows

Prompt

Conduct research in Feedly on the latest TTPs for Scattered Spider and conduct a threat hunt in my SIEM. Then share the findings in Slack using the threat hunting Notion template.

Result

This demo shows true orchestration: the Threat Graph MCP Server working alongside other MCP tools to automate a complete threat hunting workflow.

The automated workflow:

1. Feedly MCP queries the Threat Graph for Scattered Spider intelligence.
2. Generates specific Wazuh queries based on extracted IoCs and TTPs.
3. Structures findings using your Notion threat hunting template.
4. Posts formatted results to your Slack channel.

What you get: A complete, documented threat hunt with:

• Intelligence context from Feedly's Threat Graph
• Ready-to-run SIEM queries
• Structured documentation in your existing format
• Team notification with key findings

Why it matters: MCP isn't just about querying data. It's also about integrating real-time threat intelligence into your existing workflows. The context from Feedly's Threat Graph flows directly into your security tools, eliminating the copy-paste shuffle between platforms and ensuring your hunts are based on current intelligence.

From signals to action in minutes

Context makes AI better. Web search gives you fragments, while the Feedly MCP Server, extracting context from the Feedly Threat Graph, gives you a complete, connected picture. By automating threat investigations that used to take hours, your team can prioritize faster, respond sooner, and reduce risk exposure. Your AI tools now operate with real-time context, making responses actionable, verifiable, and ready when threats emerge.

Automate CTI workflows with Claude and the Feedly Threat Graph

Feedly’s MCP Server gives AI tools the context they need to deliver more accurate CTI responses.

Book Demo

Market Intelligence

Strategic intelligence at the speed of change

WHY- Part 1

Tino Klaehne

on Oct 27, 2025

Why (most) innovation fails

Organizations aren’t short on ideas. They’re short on insight.

Teams can brainstorm endlessly, but initiatives stall without understanding customers, markets, and environmental shifts. Ideas without insight become noise.

A top reason startups fail is “no market need.” This happens not due to a lack of creativity, but a lack of aligned insight. The same pattern plays out inside large organizations. They rarely fail because of a shortage of ideas, but because they cannot identify which ideas deserve attention and investment.

This gap has become more pressing as corporate innovation budgets shrink. Companies must be more strategic about where to place their bets with fewer resources. It’s no longer enough to rely on gut feeling. Leaders need evidence that an opportunity is real, urgent, and valuable.

Innovation leaders complain not about a lack of ideas, but too many projects, directions, and unclear priorities.

The challenge isn’t idea generation. It’s portfolio management: separating signal from noise and investing where insight proves momentum.

Innovation starts with insights.

Not data alone. Not a lab full of talent. Not just budget or ambition. Without insight, innovation spreads itself too thin, solving the wrong problems or chasing nonexistent opportunities. With insight, innovation has a solid foundation to guide strategy and create impact.

This series explores how companies can build operating systems for strategic intelligence and research so insights are built into the core of innovation.

Strategic intelligence is flawed

Traditional approaches, one-off research, siloed insights, and periodic reports can’t match the pace of change.

The Strategic Intelligence Cycle has three phases: Analysis to process signals, Synthesis to create meaning, and Genesis to drive action.

What’s failing isn’t a tactic; it’s the cycle itself:

1. Analysis: Overwhelmed by volume without structured filtering
2. Synthesis: Insights remain fragmented, and there is no shared sense-making
3. Genesis: Intelligence rarely shapes decisions or resource allocation

Result: missed emerging opportunities, backward views, and slow, costly bets.

This is why every company, not just tech giants or consultancies, must consider creating an Insight OS: an operating system for Strategic intelligence.

An Insight OS manages processes, tools, and data sources to continuously sense the environment and inform decision-making. It is a framework that ensures systematic, repeatable, and strategy-aligned research efforts rather than disconnected, ad-hoc initiatives.

The increasing complexity of intelligence work

The job of corporate researchers and innovation teams has never been more complex. The volume of data, news, and external signals is overwhelming. Markets are volatile, new technologies emerge rapidly, and competitors can arise unexpectedly. Traditional business intelligence, focused on quarterly results and internal dashboards, isn't enough.

This complexity requires mastery of all three phases of the Strategic Intelligence Cycle:

1. Processing large data streams while maintaining signal quality (Analysis)
2. Converting fragmented insights into a clear strategic understanding (Synthesis)
3. Ensuring intelligence shapes decisions and generates value (Genesis)

Traditional approaches fail to complete this vital cycle, as they focused on data gathering and periodic reporting.

Today, companies face rapidly evolving threats and opportunities, so they establish strategic intelligence functions to complement their traditional analyses. Monitoring the external environment is now a strategic imperative, not a luxury.

Teams must gather strategic intelligence (long-term, big-picture insights) alongside day-to-day business intelligence (operational metrics). Tactical data about today’s sales or this quarter’s competitor moves must be balanced by exploring emerging trends that could disrupt the industry in a few years. Strategic intelligence isn’t about predicting one future with certainty; it’s about being prepared for multiple possibilities and staying agile.

The curator’s mindset

This complexity is shifting researchers’ roles. Corporate researchers are becoming strategic curators and sense-makers, instead of just gathering data. Their mission is filtering signal from noise, connecting the dots between disparate information, and translating insights into strategic direction. They must curate intelligence to set the company’s future agenda, rather than just reporting past events.

A momentum-based approach to innovation

Traditional innovation strategies are falling short in our dynamic business environment. They’re rarely informed by concrete data, difficult to quantify, and too rigid for rapidly changing markets. Their implementation is slow and requires significant investment. They fail to consider multiple bets, and remain too focused on past experiences rather than future possibilities.

Strategic Intelligence isn't just about finding a needle in a haystack; it's about recognizing many surrounding haystacks. The real opportunity might not be a needle at all. It could be something else entirely. Something that's here now, but won't be for long.

The solution is a momentum-based approach to innovation.

This approach requires mastering all three phases of the Strategic Intelligence Cycle to understand momentum:

1. Track markets, technology, and behavior with continuous sensing (Analysis)
2. Explain why some shifts accelerate while others stall (Synthesis)
3. Convert momentum into resource shifts and strategic advantage (Genesis)

Outcome: It’s not about being first; it’s about being in motion, in sync, and faster to clarity.

Without this cycle, organizations either miss significant movements or fail to capitalize on detected momentum.

Instead of relying on first-mover advantage, momentum-based innovation recognizes that successful strategies emerge from observing what's moving, why it's moving, and where it's heading. It's not about being first; it's about being in motion and in sync with the forces shaping the business landscape.

A momentum-based strategy requires you to:

• Maintain continuous sensing capabilities.
• Map out the push, pull, and weight forces in your environment.
• Allocate resources based on evidence, not gut feeling.
• Act quickly while staying flexible.

When organizations learn to read these forces together, they stop just spotting trends; they start understanding why some trends build momentum while others stall. This understanding emerges from the complete Strategic Intelligence Cycle—analyzing movements, synthesizing patterns, and generating strategic value from momentum insights. That is when foresight becomes a strategic advantage.

The future doesn't arrive out of nowhere. It compounds from the accumulation of decisions, behaviors, narratives, and innovations already in motion.

As the saying goes, the future is built today.

Most organizations today have eyes and ears everywhere: news alerts, dashboards, and trend reports, but they lack the system to process the data. They collect data, but don't synthesize it. They react quickly, but rarely reflect deeply. They excel at Analysis but struggle with Synthesis and Genesis. They are not intelligent; they are just busy.

The result is an organization with inputs everywhere, but no coordinated awareness. Without this complete cycle, organizations remain stuck in a loop of collecting more data while generating less value.

Beyond data theatre

Many organizations participate in Data Theatre, where data is presented for credibility. However, biases, selective interpretation, and a focus on internal metrics drive real decisions.

Phase-specific data theatre

Analysis theatre

• Quantity illusion: Collecting to appear comprehensive. Tell: “We have dashboards for everything” but no decision changes.
• Selective spotlight: Confirming data only. Indicate: dissenting evidence is “out of scope.”
• Internal echo chamber: Internal metrics overshadow external signals. Tell: competitor, culture, or policy scans are done as needed.

Synthesis theatre

• Dashboard mirage: Visuals without understanding. More charts after every miss, same outcomes.
• KPI fetish: Metrics over meaning. Say: “We reached the target” but can’t explain the momentum.
• Correlation confusion: A story without causality. Tell: pivots justified by shallow relationships.

Genesis Theatre

• Data diversion: Insight never reaches decisions. Every quarter, tell: “Not the right time.”
• Post-hoc justification: Data used to support a choice, not direct it. Indicate: decision comes before “analysis.”
• Expert iillusion: Complexity masks inaction. Tell: more reports, no resource reallocation.

The antidote: Measure time-to-decision, not report volume, by carrying out the full end-to-end cycle.

A momentum-based approach cuts through this theater by focusing on actual movement and acceleration rather than static snapshots or cherry-picked metrics. It demands authentic execution of the whole Strategic Intelligence Cycle—from systematic Analysis through genuine Synthesis to real strategic Genesis.

Moving beyond Data Theatre requires more than better data or smarter analytics. It demands a fundamental shift in how organizations approach intelligence work.

Even those mastering the basic Strategic Intelligence Cycle, analyzing data systematically, synthesizing real patterns, and generating value, face a greater challenge. While they're working through their cycle, the opportunities they seek are disappearing. This moves us from a static to a dynamic search problem, where success depends not just on completing the cycle, but on doing it quickly enough to matter.

Finding ice cubes in haystacks

Earlier, we mentioned the problem of multiple haystacks. But it gets worse. The things you're looking for? They're not static. They're melting.

Everyone loves the old metaphor of searching for a needle in a haystack, especially in innovation. But what if that metaphor is wrong? The problem isn't just that we don't know where to look; it's that we don't know what we're looking for. It's not necessarily a needle. And more importantly, it's not just one haystack.

Today, companies don't operate in clearly defined industries. They compete in multiple arenas, across shifting playing fields, with no singular "right" market or direction. That means they aren't dealing with just one haystack—they have many. And the real challenge? Whatever breakthrough, trend, or opportunity they seek isn't waiting to be discovered. It's melting.

You aren’t searching one haystack for a needle. You’re scanning many haystacks for ice cubes. Opportunities form, melt, and vanish.

Extend the cycle with a time constraint:

1. Analysis: Continuously scan multiple haystacks
2. Synthesis: Spot patterns signaling “ice formation”
3. Genesis: Move before the cube melts

If your cycle moves slower than the melt rate, you’re optimizing for puddles.

An insight operating system shortens the path to clarity and increases efficiency and effectiveness.

Taking action: Your strategic intelligence audit

The standard for staying ahead is increasing, but so is the potential reward. Those who create a robust InsightOS can anticipate and act on change faster than competitors, transforming uncertainty into opportunity.

Ready to evaluate your organization's strategic intelligence capabilities? This audit reviews your execution of each phase in the Strategic Intelligence Cycle:

1. Sensing mix (Analysis): What percentage of leadership attention is external versus internal? Target ≥ 30% external. Score: 1 2 3 4 5
2. Integration cadence (Synthesis): When did cross-domain insights inform a major decision? Target: within last 90 days. Score: 1 2 3 4 5
3. Foresight depth (Synthesis): What percent of planning explores >12 months? Target ≥ 30%. Score: 1 2 3 4 5
4. Momentum map (Synthesis → Genesis): Can you name the top 3 accelerating trends and explain why? Target: yes, with drivers and counters. Score: 1 2 3 4 5
5. Response time (Genesis): Signal-to-decision cycle time. Target: weeks, not months. Score: 1 2 3 4 5

Scoring:

• 20-25: Expand your operating system.
• 14-19: Solid base. First, fix your slowest phase.
• ≤ 13: Many inputs, little advantage. Unblock Synthesis or Genesis.

Identify your lowest-scoring phase. In the next article, we’ll map it to InsightOS capabilities and a 30-60-90 upgrade plan.

In the next article, we'll explore how the InsightOS framework can help you build the intelligence architecture needed to close these gaps and create a true strategic cortex for your organization.

About Tino

Tino Klaehne is an insights professional and strategic innovation expert with over 15 years of experience converting weak signals into strategic direction. He designs systems and frameworks to help organizations decode what’s next. Honored on the 2025 Greenbook Future List of emerging insights leaders, Tino currently shapes innovation at Lufthansa Innovation Hub, where he builds an insights operating system to create agenda-setting insights at scale.

Threat Intelligence

6 Cyberattack Intel Agent examples

Filtered views suggested by our Threat Intelligence Advisors

Shawn Jaques

on Oct 23, 2025

Feedly’s Cyberattack Intel Agent enables you to be the first to know about relevant attacks, spot patterns, and prioritize your analysis. It's powered by the Real-Time Threat Graph, providing you with current and relevant attack context in a single view, enabling quick analysis and custom reporting. It collects data from over 10,000 OSINT sources, including SEC filings and regional stock exchange reports.

What makes an effective Cyberattack Intel Agent view? We asked Feedly Threat Intelligence Advisors to provide their favorite and most useful configurations and explain how clients use them to protect their organizations.

Example 1: Trending cyberattacks

Most CISOs want to be aware of what's going on, not just in their industry, but in cybersecurity in general. This trending cyberattacks view ensures that you don't miss any emerging attacks, or even those that are making headlines in sources you might not follow.

The “What? So What?” column helps you immediately understand not only what happened, but often, who was behind it, how they operated, and what to watch for.

Example 2: Industry cyberattacks

If threat actors are targeting your competitors, they are likely to target you next. Why? Many industries use similar software, processes, and defensive postures. If a threat actor finds success targeting one company in the industry, they are likely to pivot to the next. This view narrows cyberattacks to those affecting companies in a specific industry, such as finance.

For any listed attack, you can explore the Cyberattack Insights card for additional details, including the timeline, threat actors, malware, and more. You can also read source articles at the bottom of the cards to see the original context.

Example 3: Supply chain attacks

When a vendor, supplier, or service provider is compromised, attackers can use that entry point to pivot into your environment through legitimate access credentials, compromised software updates, or shared data.

Within Feedly, you can create a Custom List of your critical vendors, suppliers, and service providers. This Custom List functions as an AI Model in the Cyberattack Intel Agent, allowing you to filter for attacks specifically targeting companies in your supply chain, ensuring you stay informed about threats that could affect your organization's extended attack surface.

Example 4: Ransomware

Ransomware remains one of the most disruptive threats facing security teams, with new variants and groups emerging regularly. Tracking emerging ransomware helps you identify which groups are actively targeting your industry, understand their evolving tactics, and spot attack patterns before they impact your organization.

The Cyberattack Intel Agent allows you to filter specifically for ransomware attacks, providing a focused view of recent incidents with full context, including ransomware families, targeted industries, threat actors, TTPs, and IoCs. This visibility enables you to update detection rules, prioritize patching efforts, focus your threat hunting, and brief stakeholders on emerging risks before you respond to an active incident.

Note: The "Ransomware attacks" and "Ransomware" AI Model are distinct filters that behave slightly differently. Selecting "Ransomware attack" surfaces incidents where ransomware was the cause, even if the specific ransomware is not attributed. The “Ransomware” AI Model would only include attacks where a Ransomware program was named in the attack.

Example 5: Attack types

Different attack types require different defensive strategies, and understanding which threats are actively targeting organizations like yours helps you prioritize security controls effectively. The Cyberattack Intel Agent enables you to filter by specific attack types or track multiple simultaneously, giving you a focused view of what matters most to your environment.

Example 6: Geographic Threat Monitoring

Cyberattacks rarely happen in isolation. When threat actors successfully compromise organizations in your region, they often reuse those same TTPs against similar targets. Early awareness enables proactive defense.

This filter enables security teams to determine if their peers, suppliers, or partners within their geographic region are experiencing attacks. Adding filters, such as industry or product, to your tech stack can further refine the attacks to only those relevant to you, so you can prioritize threats and implement appropriate monitoring or mitigation controls.

Summary

The Cyberattack Intel Agent delivers precision filtering based on your intel needs, so you can focus your time and energy on relevant attacks. We provided some simple yet powerful examples of how you can use filtering to achieve different objectives. Ideally, it also inspired you to think of how you could combine these filters for even more precision.

Track attacks in real time

To explore how this could expedite your workflows, reduce unwanted surprises, and reduce Mean Time To Respond (MTTR), schedule a demo.

Start Free Trial

Threat Intelligence

Action critical threats instantly: Send new intel directly to Slack

Deliver relevant threat alerts to your CTI team, directly in their workspace

Jay Feyerabend

on Oct 16, 2025

15 Second-summary

Notify your team in real-time about relevant cyber threats with Feedly’s new Slack integration. Connecting your Feedly Boards and AI Feeds directly with Slack automates the sending of reports directly to where your team collaborates.

With this new integration you can:

• Decrease time to action intelligence on cyber attacks, vulnerabilities, ransomware, and more.
• Reduce time spent reading with summaries and automatic deduplication.
• Quickly collect and process reports in dozens of languages with automatic translation.

Use Threat Intelligence found in Feedly to trigger incident response faster directly within Slack.

For CTI teams, speed and focus are critical. Analysts sift through thousands of sources, but fragmented tools and noisy channels often bury vital intelligence, slowing response and action.

We’ve rebuilt our Slack integration from the ground up to solve these challenges. Now officially available on the Slack Marketplace, Feedly’s new integration is designed to deliver timely, relevant, and actionable threat intelligence directly into your team’s collaborative workspace while addressing the strictest security and privacy concerns.

Receive real-time alerts on new cyber attacks, vulnerabilities, ransomware, and more

The new integration allows you to receive alerts from your AI Feeds and Boards directly into any Slack channel. This means you can route reports with tactical intelligence, like malware analysis, vulnerability disclosures, or threat actor TTPs, to the specific teams that need it most. By embedding intel dissemination directly into your stakeholders’ existing workflows, you ensure that critical alerts are seen and actioned upon immediately.

Reduce time spent reading with summaries and automatic deduplication

To save analyst time, the integration uses summaries and automatic deduplication. Instead of receiving multiple notifications for the same event, Feedly bundles them, cutting down on noise so your team can focus on unique threats. Each alert includes a concise summary, allowing analysts to assess the relevance of an article in seconds without leaving Slack. This helps teams triage alerts faster and prioritize analysis more effectively.

Quickly collect and process reports in dozens of languages with automatic translation

Cyber threats know no borders. The new integration automatically translates the titles and summaries of articles from dozens of languages into English when Multilingual is included in your Feedly Plan. This powerful capability allows your team to stay ahead of threats using regional sources from around the globe. It breaks down language barriers, expanding your visibility of the global threat landscape from a single, unified view in Slack.

Summary

The new Feedly for Slack integration provides CTI teams with dynamic intelligence dissemination. With real-time alerts, summaries, smart deduplication, and automatic translation, you can cut through the noise, accelerate your response time, and shift from reactive to proactive intelligence operations.

Keep your team informed on real-time intelligence

Filter cyber intel to identify attack chains, victims, attributions, and more with Feedly's integration for Slack.

Connect Feedly to Slack

FAQs

Threat Intelligence

Prompt engineering: Generate red team emulation plans

How rich context and sophisticated prompting produce actionable reports

Andrew Castro

on Oct 07, 2025

Description

This Ask AI Prompt generates comprehensive red team emulation reports that translate raw threat intelligence into actionable attack procedures. The structured output aligns with the MITRE ATT&CK framework, providing specific emulation steps, tool recommendations, and environmental considerations. This enables red teams to quickly develop realistic adversary simulations without spending days manually parsing through threat reports.

Providing the right context

To achieve the best results from your prompt, it's essential to provide the AI with high-quality, technical context. You can do this easily within Feedly by selecting dense articles in a Feed or curating a Board with articles or reports that mention the specific threat actors, campaigns, or malware families you want to emulate. For example, say you've collected reports on APT41's GodRAT financial targeting campaign. Having this curated set of relevant intel ensures the prompt provides the AI with the right context to generate an actionable and verifiable red team emulation plan.

Ask AI Prompt

<role>Lead Cyber Threat Intelligence Analyst</role>

<task>Read the provided threat intelligence articles and generate a structured Adversary Emulation Report to support Red Team operations. The goal is to 
simulate realistic threat actor behavior based on recent tradecraft observed in the wild.</task>

<output_format>
1. Summary of Threat Activity
- Threat Actor (if known)
- Campaign or Attack Name (if applicable)
- Targeted Sectors/Industries
- Reported Objective (e.g., data exfiltration, ransomware deployment, espionage)
- MITRE ATT&CK Tactics & Techniques
- Tools, Malware, or Frameworks Used
- Relevant CVEs (if exploitation was part of initial access or lateral movement)

2. Attack Procedures (Emulation Steps)
For each procedure, provide the following details:
- Step Name: [Short title of the simulated attack phase]
- Tactic: [MITRE ATT&CK Tactic — e.g., Initial Access, Persistence]
- Technique ID & Name: [MITRE ATT&CK Technique — e.g., T1566.001 - Spearphishing Attachment]
- Procedure Description: Technical detail of how the technique was used, including commands, payloads, or LOLBins. Highlight novel chaining techniques if observed.
- Emulation Plan: Exact steps to emulate this behavior with tools such as manual commands, Cobalt Strike, Brute Ratel, Mythic, Atomic Red Team, or Caldera. Include preconditions and payload examples.
- Environment Considerations: Infrastructure or configurations required (e.g., phishing server, domain controller, PowerShell remoting).

3. Detection Opportunities
- Log Sources & Event IDs
- Telemetry Requirements
- Known Sigma Rules or Detection Samples
- Blind spots or evasions observed

4. Suggested Purple Team Collaboration Opportunities
- Techniques that benefit from validation
- Coordinated tests to measure fidelity, tune detections, or validate response
- Suggested KPIs (dwell time, detection latency, alert-to-investigation timing)

5. Mitigations and Hardening (Optional)
- High-level mitigations aligned to MITRE M-codes (e.g., M1047 – Audit PowerShell logging)
</output_format>

<guidelines>
- Ensure emulation steps reflect observed tradecraft
- Prioritize fidelity and align with MITRE ATT&CK standards
- Avoid vague descriptions—use real payloads, delivery methods, and sources
- Include specific tool commands and configuration details
- Focus on actionable procedures that can be executed
- Include citations to source material
</guidelines>

Ask AI Response

The output provides a comprehensive emulation report covering seven attack procedures, from steganographic payload delivery to internal C2 via compromised SharePoint. Each step included specific commands for tools like msfvenom, Impacket, and custom Python scripts, along with detailed environmental requirements.

The prompt can be saved in your prompt library and reused across different threat actor campaigns to maintain consistency in your red team planning process.

Try Ask AI in Feedly Threat Intelligence

Generate actionable red team emulation plans from your threat intelligence in seconds.

Start Free Trial

Threat Intelligence

Cyberattack Intel Agent: Discover and monitor relevant cyber attacks

Filter cyberattacks to identify attack chains, victims, attributions, and more

Shawn Jaques

on Sep 25, 2025

15-Second summary

CTI analysts must identify relevant cyberattacks within minutes of public reporting, quickly assess their impact and relevance, collect actionable intelligence, and inform stakeholders.

The new Cyberattack Intel Agent and Insights Cards utilize AI, powered by a real-time Threat Graph, to provide you with attack data and the relevant context in a single view, enabling quick analysis and custom reporting.

• Discover and track cyberattacks faster with real-time updates: >10,000 OSINT sources, including SEC filings and regional stock exchanges.
• Get full attack context: Attack summary, timeline, threat actors, malware, IoCs, TTPs, and CVEs, all powered by the real-time Feedly Threat Graph.
• Zero in on cyberattacks that matter with precision filtering: Industry, country, attack type, actors, malware, filters, and third-party lists.
• Rapidly create attack reports: Open a Cyber Attack Insights Card to get full details, and create a custom report with Ask AI.

The Cyberattack Intel Agent enables you to be the first to know about relevant attacks, spot patterns, and prioritize your analysis. Now you can go from discovery to analysis to actionable intelligence within minutes.

Overview on how the Cyberattack Intel Agent filters work and showing you how to dive into an Insights Card for deeper context on an attack.

The challenge

CTI teams face an overwhelming challenge: quickly identifying relevant cyber attacks from thousands of daily reports scattered across disparate sources.

Unfortunately, it’s easy to get caught up reading about attacks that prove to be irrelevant to your organization. It’s also easy to miss an attack that appears in a source you didn’t check. The result? Teams struggle to distinguish routine incidents from attacks that could directly impact their organization's infrastructure, supply chain, or industry vertical.

The Solution

Feedly's new Cyberattack Intel Agent and Insights Cards are built on Feedly’s Real-Time Threat Graph and powered by AI to aggregate attack data from thousands of sources and present the full context in a unified view. Analysts can rapidly analyze attacks and create actionable reports in minutes.

Toggle from ‘Cyberattacks’ to ‘Trends & Visualizations’ to uncover charts and overviews.

Discover and track cyberattacks faster with real-time updates

The Cyberattack Intel Agent continuously monitors thousands of OSINT sources, ranging from security publications to SEC filings and regional stock exchanges, where breach disclosures typically emerge first. The data is extracted by Feedly AI into the Threat Graph, adding context to the data and ensuring you're among the first to know when attacks impact your industry or supply chain partners.

The “What? So What?” column helps you immediately understand not only what happened, but often, who was behind it, how they operated, and what to watch for. It gives you the Bottom Line Up Front (BLUF). Combined with the integrated trends, you can quickly assess whether you're seeing isolated incidents or the beginning of a coordinated campaign.

'What? So What?' column developed to providing structured insights so analysts can quickly identify relevant attacks and focus their investigation efforts on high priority attacks.

Get full attack context

Instead of piecing together attack details from multiple sources, you get the complete context in one view. Each attack entry provides the essential intelligence elements you need for rapid assessment (all enriched by Feedly’s Threat Graph):

• attack summary
• timeline
• threat actors
• associated malware families
• IoCs
• TTPs
• relevant CVEe

This eliminates the time-consuming process of cross-referencing different databases and threat feeds to build a thorough picture.

Zero in on cyberattacks that matter with precision filtering

The Agent's precision filtering enables you to cut out the noise and focus on what truly matters to your security posture by narrowing results based on industry, country, attack type, threat actor, and malware family. The filtering helps ensure your analysis time is spent on threats with genuine relevance to your organization, rather than generic attacks that have no bearing on your risk profile.

Fine-tune the Cyberattack Intel Agent for your research and instantly reduce 1098 attacks to the 48 most relevant.

Custom lists allow you to create targeted monitoring for your critical suppliers, partners, and service providers. You can use them to filter attacks targeting companies or products in your supply chain, providing the visibility needed to assess potential downstream impacts on your operations and protect your extended attack surface. In this example, we added a Custom List of our company’s tech stack to the filter.

You can add Custom Lists to your filter to discover cyberattacks in your tech stack.

Dive deeper and create attack reports

Click into any attack to view the Cyberattacks Insights Card, a comprehensive intelligence view structured to support quick reporting and dissemination. These cards consolidate all available information about a specific incident that has been collected and correlated in the Real-Time Threat Graph, including a summary, victims, IoCs, trends, and supporting articles. The timeline can be especially helpful, showing details about the initial compromise, techniques used, recovery details, and legal repercussions.

Open the Cyberattacks Insights Card in one click to get an even deeper attack overview.

One more thing: Quickly create flash reports

Ask AI enables you to generate custom reports tailored to your stakeholders' needs, whether you're briefing leadership on strategic implications or providing technical teams with actionable IOCs. You can create reports in seconds using expert-suggested prompts or your own custom prompts. Reports include citations to sources, allowing you to quickly verify the information and providing a historical record of your evidence-based assessment.

You can create a flash report that summarizes risks and business impact in just a few seconds.

Use Ask AI to create reports in seconds.

You can customize your reports to generate the response you need. For instance, you can create an incident report that includes the Diamond Model of Intrusion Analysis, timelines, and other relevant details.

Prompt

Create an incident report.

Include:
1. Executive Summary (<300 characters)
2. Diamond Model of Intrusion Analysis
3. Indicators of Compromise (IOCs)
4. Event Analysis (mermaid chart)
5. Business and Industry Impact
6. Recommended Actions & Next Steps

Tailor your Ask AI questions with clear prompts for the most relevant results.

Summary

The new Cyberattack Intel Agent and Insights Cards eliminate the manual, time-intensive process of tracking and analyzing cyber threats across disparate sources. With precision filtering, third-party monitoring, trend visualization, and streamlined reporting via Ask AI, you can cut through the noise and create actionable reports, reduce stress, and shift from reactive to proactive intelligence operations.

Don’t wait until it’s too late - track attacks in real time

Filter cyberattack intel to identify attack chains, victims, attributions, and more with Feedly's Cyberattack Agent.

Start Free Trial

Market Intelligence

Uncover emerging trends within your industry

Create an industry specific Emerging Trends Dashboard

Jay Feyerabend

on Aug 12, 2025

The problem: Relevant trend discovery is buried in noise.

For market intelligence teams focused on a specific sector (whether it’s healthcare, financial services, energy, or technology) the challenge isn’t a lack of data. It’s separating relevant, high-impact developments from the noise of low-value chatter

Industry-specific trend research means navigating hundreds of articles, trying to spot what truly matters, often wasting hours only to surface signals that are too broad or off-target. Worse still, missing a credible early signal in your space can mean getting caught flat-footed while your competitor seizes the opportunity.

Feedly’s Emerging Trends Dashboard cuts through this noise by surfacing relevant rising trends within your chosen industry, so your team spends less time searching, and more time analyzing what matters.

Why early signals matter

Spotting an emerging signal early in your industry gives your organization a strategic edge. Whether it’s a shift in industry-specific regulation, a new technology gaining traction, or a changing consumer behavior, early detection allows your team to:

• Investigate and validate the signal before it becomes mainstream.
• Engage internal stakeholders with timely, contextual insights.
• Build proactive strategies instead of reacting to late-breaking headlines.

Tracking industry signals over time also reveals how a trend is evolving. Is it showing up in competitor activity? Are new patents, partnerships, or funding announcements connected to it? Feedly helps you build dashboards specific to your industry and context so you capture these signals as soon as they reach visibility and stay on top of your market.

Emerging Trends Dashboard specific to the healthcare industry.

How to build an industry specific dashboard

Start by creating a dashboard focused on your target industry or industries. Feedly lets you choose from broad industry categories such as Healthcare, Energy, Retail, Financial Services, and more. Many teams build dashboards not only for their primary industry but also for adjacent sectors to spot signals that could cross over.

For example, a pharmaceutical team might create dashboards for Healthcare, Biopharma, and MedTech, ensuring they capture signals from all relevant ecosystems.

Creating a new Emerging Trends Dashboard.

Refine with a Custom Filter

Once you’ve created a broad dashboard to monitor industry trends, you can narrow your focus using a Custom Filter. A Custom Filter lets you specify exactly what you're looking for, like healthcare industry trends related to medical devices or genetic diseases. Using these filters lets you explore broader trends that cover your entire industry as well as niche ones that are specific to a segment of your industry.

Adding a Custom Filter.

How to tag and monitor interesting trends

You can create custom tags based on your company or industry classification methodology. Easily tagging trends of interest is a powerful way to ensure that important insights aren't lost and that your teammates immediately understand the context and category of each tagged trend. One popular tagging methodology we see is the PESTEL method, which allows for a 360 degree view of an industry, as well as a deep dive into specific types of trends This shared tagging system helps maintain consistency across your team’s research and makes collaboration more seamless.

Here are a few additional tips on how to organize, classify, and use tags in the Emerging Trends Dashboard.

Adding a Tag.

Be the first to know about the next big trend

Let Feedly wade through the sea of weak signals to surface industry trends as they emerge.

Start Free Trial

Fundamentals

Effortless onboarding for new team members in Feedly

Streamline your teammates’ onboarding with a personalized experience

Ana Moya

on Aug 07, 2025

15 Second-summary

Our new invite flow with role-based access makes onboarding smoother and more secure for growing teams.

Now you can:

• Invite teammates in seconds with a built-in onboarding flow.
• Assign Admin, Editor, or Viewer roles for better security control.
• Help new users get up to speed quickly with a guided walkthrough of your team’s Boards, AI Feeds, Dashboards, and Newsletters.

It’s a faster, smarter way to help your team feel confident and productive from day one, while unlocking more value from Feedly.

Here’s a quick guide to help you onboard smoothly:

Step 1: Invite multiple members in seconds

• Navigate to feedly.com/i/team/users.
• Click ‘Invite Members’.
• Add their email address.

Pro tip: You can add multiple team members at once.

Step 2: Assign Admin, Editor, or Viewer roles for better security control

• Admins: Can access team settings, billing, and manage other members.
• Editors: Can create and manage shared content such as team folders, boards, dashboards, and newsletters. Editors don’t have access to administrative settings.
• Viewers: Have read-only access to all shared content.

🔗 Learn more about team roles and permissions

Step 3: Set up their guided experience

Select which Team Boards, AI Feeds, Newsletters, and other content your new members will see when they log in for the first time.

Step 4: Send the Invitation

Once you invite your team, they’ll receive an email with a link to join.

You’ll be notified as soon as they accept.

The result?

The Get Started Page dynamically adapts based on your team’s shared content, the inviter’s role, and your Feedly Plan. It also offers an easy way for new users to reach out to your Customer Success Manager if they need extra support or have questions.

Threat Intelligence

Feedly’s CVSS Estimate Score - Bridging the gap to enhance vulnerability intelligence

An early warning system for high-risk vulnerabilities without official scores

Alessandro Magi

on Jul 24, 2025

The scoring challenge: 25,000+ CVEs await NVD analysis

Threat Intelligence teams often rely on the Common Vulnerability Scoring System (CVSS) to triage, assess, and escalate vulnerabilities impacting their technology stacks. However, there are sometimes delays in assigning a CVSS score by industry authorities, such as the National Vulnerability Database (NVD), which is maintained by the National Institute of Standards and Technology (NIST).

As the volume of CVEs has continued to increase year over year, the NVD has struggled to keep up with the increased demand for analysis and scoring. The following report, captured on June 18, 2025, from NIST, showcases the vulnerabilities awaiting analysis.

CVE’s awaiting analysis by NVD. Accessed June 18, 2025: https://nvd.nist.gov/general/nvd-dashboard

As a result, organizations face challenges including:

• Delayed escalation of critical CVEs and inefficient remediation protocols: Without CVSS scores assigned, threat intelligence teams can struggle to prioritize, assess, and escalate CVEs to their vulnerability management team. As a result, it becomes difficult to determine which CVEs require immediate remediation, which can delay the vulnerability management team's deployment of efficient patch management protocols due to the postponed escalation of CVEs.
• Wider exposure windows: The time-to-report and subsequent time-to-patch for CVEs increase the exposure window for organizations, leaving high-risk CVEs vulnerable to potential exploitation in the wild.
• Compliance complications: Many organizations are required (such as by PCI-DSS) to address vulnerabilities above certain CVSS thresholds within specified timeframes. CVSS scoring delays can inadvertently cause organizations to miss compliance deadlines.

Feedly’s solution: CVSS estimate score

In response to these challenges, Feedly developed a CVSS estimate score to bridge the gap between CVE identification and CVSS score assignment, providing threat intelligence teams with an early warning system to monitor, assess, and prioritize CVEs with higher fidelity.

How Feedly estimates CVSS

Feedly uses a multifaceted approach built on machine learning models to estimate CVSS scores. The estimate is calculated based on the vulnerability type, description, attack complexity, and exploit info.

Data sourcing and CVE enrichment

• Feedly collects and enriches CVE data from a variety of sources including NVD, ENISA, vendor advisories, and other high-trust OSINT sources to gather proof-of-exploit (PoE) information.
• This assessment operates in near real-time, providing instant CVE insights as information emerges from these trusted sources.

Feedly continues to update its CVSS Estimate until the NVD assigns an official score; thereafter, it no longer updates the CVSS estimate. Security teams should use Feedly’s CVSS estimate as an interim measure and switch to the official score once available.

CVSS prediction process

When an article appears in Feedly, it is assessed by a series of machine learning models to analyze and predict CVSS based on the attack vector, vulnerability description, and past CVEs with confirmed CVSS scores. Knowing these past attack vectors and their relationship with CVSS scoring based on years of collected data.

Machine learning process

Feedly deploys a system of machine learning models trained on historical data where the inputs are articles mentioning the CVE. The predicted outputs represent the NVD CVSS categories which are used to calculate CVSS scores. Feedly will assess and score weighted vocabulary, historical datapoints, and patterns across articles mentioning specific CVEs to arrive at aggregated CVSS estimate scores. Feedly's CVSS Estimate system contains the following structured process:

1. Data extraction and scoring

Feedly AI builds and maintains a comprehensive dataset derived from thousands of past CVE reports. Each data point is scored based on its “importance” in relation to CVSS scoring. These associations enable machine learning models to rapidly identify vulnerabilities that are more likely to be severe, based on the data points collected in CVE and trusted OSINT reporting.

2. Probability estimation

Feedly AI then predicts the probability of a specified outcome, in this case, the likelihood that a CVE has a High (7.0-10.0), Medium (4.0-6.9), or Low (0.1-3.9) CVSS score. It assesses against historical data, determining which patterns of data are indicative of a respective score. This machine learning engine calculates the probability that a CVE belongs to one of these categories based on the weighting of these words ingested from source inputs.

3. Decision aggregation

Lastly, Feedly AI assesses combinations of data points collected and aggregates the predictions to determine a final CVSS Estimate. This machine learning model can capture complex patterns in data to arrive at a final estimated score.

Where to access CVSS Estimate scores in Feedly

Feedly’s CVSS Estimate appears in both CVE Insights Cards and the Vulnerability Dashboard, providing threat intelligence teams with a way to better track and monitor vulnerabilities impacting their technology stacks.

A sample workflow displaying recently published and trending CVE’s with High CVSS Estimates, and no CVSS Score currently assigned. This workflow shows how Feedly’s Vulnerability Dashboard actively collects intelligence against CVEs, and allows for pivot points to Insights Cards for continual monitoring of vulnerabilities.

Vulnerability Dashboard

Enable the CVSS Estimate column in your Vulnerability Dashboard to view Feedly’s estimated CVSS score for each CVE. As shown in the image below, even when an official score hasn’t been published yet, Feedly provides an estimated CVSS to help you assess severity early.

This feature is especially useful when scanning multiple CVEs at once and applying the dashboard filters to highlight only the most relevant vulnerabilities and their estimated impact.

Feedly’s Vulnerability Dashboard showcasing recently published CVE’s with High CVSS Estimates, and no CVSS Score currently assigned.

CVE Insights Cards

When deep-diving into a specific CVE, the CVE Timeline in Feedly's Insights Cards offers valuable context, including the CVSS Estimate Score. In the example below, Feedly flagged the CVSS as HIGH even before NVD officially assigned it a score of 8.8.

CVE Insights Cards are free and publicly available. Even if you're not a Feedly customer, you can explore them at feedly.com/cve to get a full 360° view of any CVE you're tracking.

As seen in this CVE Insights Card, Feedly’s CVSS Estimate of High was determined on July 15 at 12:21PM, with NVD assigning a critical score of 8.8 at 1:20PM.

In short...

In sectors where early warning systems are crucial for effective threat response, threat intelligence teams can bridge the gap between official CVSS Score assignments using Feedly’s CVSS Estimate capability, moving towards near-real-time assessment of vulnerability-related threats. By combining CVE data enrichment, machine learning models, and data-driven severity predictions, Feedly’s CVSS Estimate enables teams to efficiently identify, assess, and escalate critical vulnerabilities, facilitating faster and informed decision-making to protect their organization’s critical technology stack.

Try Feedly's CVSS Estimate Score on the Vulnerability Dashboard

If you would like to explore CVSS Estimate scores further, please contact Feedly’s Threat Intelligence Advisory team via Enterprise support at enterprise@feedly.com or start a free trial.

Start Free Trial

Market Intelligence

Unlock market intelligence insights in 15 languages

Gain a global perspective with news in other languages

Jay Feyerabend

on Jul 16, 2025

15 Second-summary

Feedly’s Multilingual AI, makes it simple to collect and translate global insights across languages, all in one place. Customers consistently tell us how valuable our multi-language coverage is in helping them stay ahead of global developments. To expand that advantage, we now support 15 languages.

With Feedly's Multilingual AI, you can:

• Search for stories across 15 languages (English, Arabic, Chinese, French, German, Dutch, Japanese, Italian, Korean, Polish, Portuguese, Russian, Spanish, Vietnamese, Ukrainian) with a single search query in English
• Use one of our 30,000+ AI Models (companies, trends, technologies, strategic moves, etc) that are pre-trained to understand aliases, nuances, and deeper meaning to surface results in foreign languages
• Save time with de-duplicated stories across languages, so you only see a story once, regardless of language.
• All articles are automatically translated into English

Feedly’s Multilingual AI expands your research to a global scale, all with a single click.

Challenge of conducting research across languages

Conducting market intelligence across multiple languages is a tedious maze of finding credible sources and translating them accurately. Researchers must sift through vast data in unfamiliar languages using limited keyword searches for only a handful of terms, and then relying on LLMs for translation that often miss nuance and industry-specific terms. The process is slow, error-prone, and risks misinformation, making global market analysis a frustrating challenge.

Luckily, with Feedly’s multilingual capabilities, you can efficiently conduct research across multiple languages, and trust your results are comprehensive and accurate.

Find stories across 15 languages with a single search

Now you can create a single search query using the same boolean logic you have grown accustomed to in Feedly and apply it to all supported languages. This ensures you see all relevant content without having to search dozens of keywords in different languages.

Use one of our 30,000+ AI Models

Feedly began building AI Models five years ago—training them to recognize and tag market intelligence concepts like industries, business events, companies, and technologies among others, in real time.

Benefits of using AI Models (vs. simple keywords)

• They exclude noisy results that aren’t actually about your topic, even if the keyword is present
• They include relevant articles even if they don’t the keyword, because Feedly AI has been trained to think like an analyst

Now those same 30,000 AI models can be used to create custom search queries across all supported languages.

Save time by de-duplicating stories across languages

As stories break, it is common for the same event to be reported by numerous sources in multiple languages. Feedly groups all of the stories about a single event together regardless of the language they were originally published in and only shows you the original, ensuring you don’t waste time re-reading articles about the same news event.

Articles are automatically translated to English

As Feedly identifies articles from across the web that meet your search criteria, they will appear in your feed in near real-time. Regardless of the language the article was published in, you have the option to automatically translate it in your feed, so you only see the English translation, or keep in its original language. However, if you prefer another language, you can translate to that language using Ask AI instead.

In short…

Keeping up with global market intelligence doesn’t have to be a tedious, fragmented process. With Feedly’s Multilingual AI, you can seamlessly search, filter, and translate insights across dozens of languages—all in one place. No more repetitive searches, missed insights, or clunky manual translations. Just fast, accurate, and comprehensive global intelligence at your fingertips.

Try Multilingual AI

Start expanding your market research with Feedly today.

Start Free Trial

FAQs

Market Intelligence

Track innovations in your industry with 9 new AI Models

Capture early innovation signals from competitors and across your industry

Jay Feyerabend

on Jun 18, 2025

15-Second Summary

Staying on top of innovations is one of the most valuable, but time-consuming, parts of market intelligence work. With the rapid pace of innovation, staying up-to-date and ahead of your competitors can seem like an impossible task for teams already under-resourced. Analysts need to sift through thousands of articles, press releases, and reports to catch early signals like new patents, prototypes, and pilot projects. To make this process faster and more scalable, we’re releasing a new set of AI Models purpose-built to automatically flag key indicators of technological & scientific innovation. These include:

• Innovation
• New Patents
• Full-Scale Prototype
• Type Certification
• Clinical Trial Phase I
• Clinical Trial Phase II
• Clinical Trial Phase III
• New Proof of Concept
• Pilot Project

These AI Models help analysts spot breakthroughs earlier, monitor competitors more effectively, and spend less time searching and more time analyzing. In this article, we’ll explore what’s new and show you how to make the most of these innovation AI Models.

Narrowing the Autonomous Vehicles AI Feed by adding the new innovation AI Models.

More signal, less noise, a peek behind the scenes

Using Feedly’s AI Models makes your research 12x more relevant than traditional keyword-based search. While most search engines rely on exact keyword matches, Feedly AI goes deeper. It reads thousands of articles across the web and understands the underlying concepts, not just the words on the page. That means even if a keyword isn’t explicitly mentioned, Feedly AI can still recognize when an article is relevant and flag it. The result? Less noise, more insight, and faster access to the information that actually matters.

Innovation

Our Innovation AI Model flags instances of the development or application of new ideas, products, services, or processes that improve efficiency, solve problems, or create value. For market intelligence analysts, detecting innovation signals is critical to identifying shifts in a competitor's strategy, emerging disruptors, or changes in industry direction. This model helps surface early signs of innovation by scanning and flagging relevant mentions across a wide range of sources.

Innovation AI Model showcasing the difference between regular keyword matches and AI Models.

Prototype

Our new Full Scale Prototype AI Model was created to flag instances of an early version or sample of a product, typically built to test a concept or process. Spotting prototypes allows you to track how close a company is to bringing a new product to market. By identifying mentions of prototypes in articles, reports, or press releases, you get an early look into product development pipelines and potential future offerings.

In this example, we are choosing to pull from the Press Release source bundle. Remember, in Feedly, you have the flexibility to pick your research sources. For more information on Press Release sources, check out this blog: Turn press releases into competitive signals.

AI Feed tracking full scale prototypes in the aviation industry, pulling from PR sources.

Clinical Trials

This AI Model automatically flags references to trials, making it easier to monitor this highly regulated and impactful phase of development. For analysts focused on the healthcare or biotech sectors, tracking clinical trials provides insights into where competitors are investing, what treatments are in development, and how soon innovations might reach the market.

In this example, we’re using Ask AI across multiple articles to extract a table tracking the recent critical trials for cardiovascular diseases with the prompt:

Build a table tracking the recent clinical trials. Include the name of the drug manufacturer, the phase of trial, the result, and the potential impact

Running an Ask AI prompt across multiple articles on an AI Feed about clinical trials for cardiovascular diseases.

New Patents

By identifying and surfacing new patent filings, you get to track competitor innovation, assess potential IP conflicts, and uncover opportunities in a given market. New patents signal formal claims of innovation and are often early indicators of strategic investment in a technology. They offer a unique window into a company's R&D focus and long-term plans.

In this example, we’re using Ask AI on a single article to extract more details about Xiaomi’s solid-state battery reveal, using the simple prompt:

What details did Xiaomi reveal about its solid-state battery patent?

Running an Ask AI prompt on a single article to dive deeper into Xiomi’s new patent reveal.

New Proof of Concepts

Our new Proof of Concept (PoC) AI Model identifies instances where a company demonstrates the feasibility of a new idea, technology, or approach. Proofs of concept are valuable signals for market intelligence analysts because they indicate a shift from theoretical development to practical validation. Flagging these moments helps spot early-stage innovations that could evolve into full-scale products or services.

Once you’ve built an AI Feed using the Proof of Concept AI Model (or any of the other models mentioned in this article), click on the Top Stories tab to quickly spot the main stories related to your search.

Using the Top Stories Tab in an AI Feed to discover the most popular stories regarding your research query.

Type Certification

This AI Model flags instances where a company or product receives type certification—an official validation that a product meets regulatory or technical standards, especially in sectors like aerospace, automotive, or energy. For analysts, these certifications are key milestones that signal readiness for market entry or compliance with industry standards. Tracking them helps assess maturity and competitiveness within regulated markets.

At the top of each article, you’ll find AI Metadata to let you know the type certification mentioned in the article, making it easier to extract key insights at a glance

Pilot Project

Our Pilot Project AI Model identifies when organizations launch small-scale, experimental implementations of a product, service, or technology in a real-world setting. For analysts, pilot projects are strong indicators of market testing and operational viability. Monitoring these efforts can reveal which innovations are gaining traction, where companies are deploying them, and how they are being received.

You can select the Insights Tab in your AI Feed to understand how the number of pilot projects in your industry has evolved, as well as the key companies, technologies, and sustainability topics most mentioned within the feed.

Visiting the Insights Tab in the AI Feed.

Track innovations in your industry

Use these these nine AI Models to capture early competitive signals.

Try for Free

Threat Intelligence

CVE Insights Cards: Comprehensive, real-time intelligence

EUVD IDs, CVSS and EPSS scores, patches, timelines, and more in one view

Gaby Zedan

on Jun 16, 2025

15 Second-summary

Exploited or critical vulnerabilities need to be addressed fast, but gathering the right context often takes hours of manual research.

Feedly’s CVE Insights Cards eliminate that bottleneck.

They aggregate, analyze, and synthesize vulnerability intelligence from across the web in real time, so CTI and vulnerability teams can:

• Get a 360° view of a CVE, its criticality, EUVD ID, exploitation status, and trending patterns.
• View a dynamic timeline of developments and pivot to threat actors, malware, TTPs.
• Read source articles and threat intelligence reports for a deeper dive.
• Use Ask AI to generate tailored reports and ask specific questions.
• Import CVE data into your TIP or triaging tools with the Feedly API.

CVE Insights Cards streamline vulnerability intelligence, so you can spend less time gathering information and more time patching and protecting your organization.

Accessing a CVE Insights Card from an article.

The challenge of monitoring CVE data and how CVE Insights Cards help

Tracking and prioritizing vulnerabilities is a complex and resource-intensive task. With 80-100 CVEs reported each day across fragmented sources, analysts are forced to spend valuable time aggregating, correlating, and validating information, often sifting through irrelevant noise to find what matters.

In today’s threat landscape, where adversaries move fast, speed and context are critical. That’s why we developed CVE Insights Cards: to centralize vulnerability intelligence, surface real-time context on critical and exploited CVEs, and accelerate decision-making. So your team can focus on what matters most: prioritizing CVEs to patch first, reducing exposure, and strengthening your organization’s defenses.

Behind the scenes on how a CVE Insights Card works

Feedly AI aggregates, analyzes, and synthesizes millions of data points from sources such as NVD, 25+ vendor advisories, GitHub, and trusted exploit databases to deliver the contextual intelligence you need to prioritize emerging vulnerabilities.

Note: When CVSS scores or CWE classifications are not yet available in the NVD, Feedly AI proactively predicts them, helping your team assess risk and respond faster.

Behind the scenes on how a CVE Insights Card works.

Get a 360° view of a CVE, its criticality, exploitation status, and trending patterns

Here’s what you’ll find in a CVE Insights Card:

• A concise summary of the CVE, including its impact, exploitation status, available patches, and mitigation recommendations.
• New: EUVD IDs for enhanced vulnerability tracking (more on this later).
• A dynamic timeline of developments enabling quick pivots to threat actors and Malware Family Insights Cards.
• Details on affected systems, available patches, and associated CWE-89 attack patterns.
• The Common Vulnerability Scoring System (CVSS) version 3.1 severity rating.
• Vector strings (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N).
• References to sources, including CTI reports for deeper analysis.
• Links to GitHub pages.
• Detection rules, if available.

All this critical information is consolidated in a single, easy-to-navigate view that’s continuously updated in real time. Feedly AI actively monitors the latest threat intelligence reports, vendor advisories, vulnerability digests, and other trusted sources to ensure your CVE Insights Card always reflects the most accurate and current data.

All three main sections in CVE Insights Cards.

New: EUVD IDs for enhanced vulnerability tracking

The addition of the European Vulnerability Database (EUVD) IDs to CVE Insights Cards brings analysts a valuable new layer of context. By linking directly to EUVD, analysts gain access to official EU-specific advisories that may not appear in U.S.-based databases. This added perspective helps teams validate findings, align with regional compliance requirements, and uncover additional remediation guidance faster.

First section of the CVE Insights Card including a 360° view of the CVE and the inclusion of the EUVD ID.

View a dynamic timeline of developments and pivot to threat actors, malware, and TTPs

CVE Insights Cards also feature CVE Timelines, designed to help you monitor the real-time evolution of critical vulnerabilities and zero-days. These timelines continuously track threat intelligence reports, vendor advisories, vulnerability digests, and more, automatically surfacing the most important developments as they unfold. This provides a clear, up-to-date view of each vulnerability, enabling your team to prioritize and respond more effectively.

CVE Timelines:

• Continuously detect and synthesize key CVE-related events and update the timeline.
• Automatically summarize high-value reports and articles for quick insight.
• Can be customized to highlight the event types you care about most.

Click here to learn more about CVE Timelines.

Second section of the CVE Insights Card is the CVE Timeline highlighting the trajectory of this specific vulnerability, including how Feedly predicted its CVSS score before official details were published by the NVD.

Read source articles and threat intelligence reports for a deeper dive

CVE Insights Cards include a curated list of sources from which the data was pulled, allowing you to dive directly into the CTI reports, vendor advisories, and threat bulletins that mention the vulnerability. This direct access to authoritative information empowers you to validate findings, understand the full context, and make faster, well-informed decisions about patching or mitigation.

Third section of the CVE Insights Card includes detailed information on affected systems, points of exploitation, available patches, links to threat actors, MITRE techniques, and original intelligence sources.

Use Ask AI to generate tailored reports and ask specific questions

Even with comprehensive data at your fingertips, there are times when you need more: specific answers to complex questions, support for custom scoring models, or data formatted to seamlessly integrate with your workflows. That’s exactly where Ask AI adds value.

Now fully integrated into CVE Insights Cards, Ask AI empowers you to extract precise insights faster and with less manual effort.

For example, we asked it to:

Create an attack chain a threat actor could use against this CVE, include a mermaid diagram and tag each step with the corresponding Kill Chain step and add MITRE t-codes where applicable.

But that’s just one of many possibilities. Explore a full range of use cases in our detailed blog post: Ask AI in CVE Insights Cards—Precise Answers for Faster Prioritization.

Ask AI answering a custom question about a CVE. It provides a response with an attack chain flow diagram, threat actor details, and a table of indicators.

Import CVE data into your TIP with the Feedly API

Feedly aggregates information from NVD, MITRE, EPSS, and other sources to build the CVE Details section of the CVE Insights Card. We normalize the details of the CVE Insights Card into a JSON structure. We also use machine learning models to analyze and enrich the content.

For more information on the API, visit: https://developers.feedly.com/reference/cve-json

JSON to be easily exported into your TIP.

Bonus: Monitor multiple CVEs in a personalized Vulnerability Dashboard linked to your tech stack and risk criteria

CVE Insights Cards are accessible through AI Feeds and appear at the top of articles, but our preferred location is the Vulnerability Dashboard.

The Vulnerability Dashboard provides a fully customizable environment that allows users to fine-tune filters, such as CVSS score, EPSS, PoC status, and vendor data, to highlight vulnerabilities tailored specifically to their technology stack. Users can save these custom views for ongoing monitoring.

Instead of wading through irrelevant information, analysts can focus directly on the vulnerabilities that pose the greatest risk to their environment, enabling more precise, risk-based decision-making.

If you are keen to learn more about the vulnerability dashboard, check out this blog: Vulnerability Dashboard: Real-time CVE intelligence tailored to your stack and risk criteria.

Selecting a CVE to launch into the CVE Insights Card for trends, timelines, and additional information.

CVE Insights Cards are constantly evolving

We’re continuously improving CVE Insights Cards to deliver deeper, more actionable intelligence. The latest additions, EUVD IDs and Ask AI, are two such examples.

Our goal is to make these cards as valuable and insightful as possible for analysts. Whether you’re triaging new threats or planning mitigation efforts, CVE Insights Cards are a powerful tool for vulnerability intelligence.

If there’s one takeaway, it’s this: CVE Insights Cards can be your go-to resource for understanding and prioritizing vulnerabilities, without the need to manually piece together information from dozens of scattered sources. Feedly AI does the heavy lifting so you can focus on what matters: reducing risk and accelerating response.

Try CVE Insights Cards

Prioritize exploited and critical CVEs faster with a unified view in CVE Insights Cards, so you can limit exposure efficiently.

Try for Free

Market Intelligence

Turn press releases into competitive signals

Feedly supports over 4,000 company press release sources so you can surface competitive signals faster

Jay Feyerabend

on Jun 10, 2025

15 Second-summary

Manually tracking press releases across thousands of scattered sources is time-consuming, error-prone, and nearly impossible to scale until now. Feedly now supports thousands of company press release sources, transforming how analysts gather and act on competitive signals.

Here’s how:

• Track over 4,000 global press release sources, including PDFs and multilingual formats, so you never miss a signal.
• Cut through noise and surface updates tied to specific products, markets, or initiatives.
• Extract structured insights, summarize documents, and compare announcements in minutes.
• Share insights with stakeholders via automated newsletters.

Selecting the Press Releases source in an AI Feed. This contains 4000+ press release sites.

The challenge of tracking press releases

Press releases are goldmines for competitive intelligence analysts, packed with strategic clues revealing a competitor’s strategy. But without the right tools, finding and analyzing these insights can be painfully slow and incomplete. Press releases are scattered across websites, often buried in PDFs, and written in multiple languages. Analysts waste hours manually searching, translating extracting, and compiling information, often missing key details or trends. This is why Feedly transformed press release coverage, adding over 4000 press releases site you can follow and search within.

If a press release site you need isn’t included, you can easily add it yourself just like in the example below:

Manually adding a PR site into Feedly.

Why press releases matter in competitive intelligence

Press releases are often the first place a company reveals major updates, such as product launches, strategic shifts, new leadership appointments, partnerships, or market entries. They provide a real-time pulse on how companies want to position themselves publicly, offering valuable context and messaging cues for competitive analysis. For intelligence teams, staying ahead of these announcements means monitoring and interpreting them quickly and at scale. With Feedly, this process becomes streamlined with the collection, synthesis and distribution happening in real time. For instance, you can create a Feed with all of your competitors’ PR sites and read through all of their articles in one place

By creating and saving a Folder with all of your competitor’s press releases, you can stay on top of all their news in a single, streamlined feed.

Comprehensive coverage, zero gaps

Feedly ensures you never miss a critical press release, regardless of format or language. Whether it’s a PDF in a corporate newsroom or an update from an international competitor, Feedly’s AI engine ingests content from various sources. To track multilingual press releases, use Feedly’s RSS Builder to monitor companies not covered by traditional feeds, and rely on a growing database that adds thousands of new press releases weekly. It’s a centralized, always-on feed of competitive signals.

Press Releas in Feedly that has been auto-translated from German into English.

Dive deeper with AI-Powered Filters

Once you identify the press releases you care about, the challenge becomes sifting through the noise. Feedly’s AI Models helps you surface what matters most. You can filter press releases to highlight those related to specific product lines, markets, or strategic initiatives. In this example we tracking mentions of sustainability related to various airports and selecting the Press Releases source. You can also exclude updates on irrelevant technologies or routine financial disclosures. The result: less noise, more targeted insights.

Creating an AI Feed to track competitor airports by pulling from the Press Releases source, which aggregates over 4,000 PR feeds.

Analyze smarter with Ask AI

Beyond filtering, Feedly helps you go deeper. With Ask AI, you can extract structured data from press releases, compare key themes across up to 25 documents, and generate concise summaries of complex announcements. You can even use Feedly to build comparison tables that track feature updates or competitive messaging over time. What used to take hours of manual effort now happens in minutes.

Using Ask AI to create a table with sustainability initiatives by airports all around the world.

Sharing instantly with Automated Newsletters

Once you collect the necessary intelligence from press releases, you can quickly share those insights with your stakeholders through Automated Newsletters. If you want a little more control over the content included in your newsletter, you can send your newsletter from a curated board of saved articles.

Newsletter showcasing relevant press releases.

Unlock competitive insights from 4,000+ press release sources

Feedly supports over 4,000 company press release sources so you can surface competitive signals faster

Try for Free

Market Intelligence

Accelerate your research with prompt suggestions in Ask AI

Get prompt suggestions tailored to the articles you are researching

Gaby Zedan

on Jun 04, 2025

15 Second-summary

Ask AI, now integrated into Feedly Market Intelligence, makes it effortless to analyze multiple articles by summarizing key points, extracting insights, and generating deliverables in multiple languages. And now, it’s even smarter.

With the new prompt suggestions feature, Ask AI automatically reads through your selected articles and recommends relevant questions to kickstart your research. These suggestions come in two forms:

• Dynamic Prompts, generated on the go by our LLM based on the content of your articles.
• Expert Prompts, carefully crafted and curated by our in-house analysts to align with your research needs.

Whether you’re diving into competitive analysis, trend monitoring, or market mapping, Ask AI helps you turn articles into insights faster than ever.

Accessing Ask AI through the Emerging Trends Dashboard and selecting one of the dynamic prompt suggestions.

Crafting the right prompt for your LLM…

Getting actionable results from an LLM comes down to tapping in to a relevant data source and crafting the right prompt. That’s why we’ve introduced prompt suggestions in the Ask AI feature, to help you get started faster. Now, when you select your articles, Ask AI will automatically suggest a prompt tailored to the content you've chosen. These are specific queries to the themes and context of the articles you're analyzing, making them especially relevant to your research goals.

The suggested prompts come in two forms. Dynamic Prompts are generated in real time by Feedly’s large language model based on the content of your selected articles. Expert Prompts, on the other hand, are carefully crafted by our in-house analysts and aligned with common investigative workflows. Both options are designed to guide your thinking, speed up your research process, and help you extract meaningful insights with less effort.

In this article, we’ll explore how these new prompt suggestions work in practice, with real-world examples and use cases that show how Ask AI can streamline your research from the very first question.

The prompt suggestions are fully accessible when you open the Ask AI panel.

Example 1 : Analyze your competitors’ strategic moves

Imagine you're a Competitive Intelligence Analyst at a fintech company, and PayPal is one of your main competitors. Simply set up an AI Feed tailored to your research focus, in this case, tracking PayPal’s strategic moves. Once you select relevant articles, Ask AI instantly suggests a prompt to help you dig deeper. One example: “How are payment companies expanding their global reach?” A question like this helps you move beyond surface-level research and uncover broader strategic insights that could impact your company’s roadmap.

Running the prompt suggestion “How are payment companies expanding their global reach” on an AI Feed tracking Paypal’s strategic moves.

Example 2 : Monitor emerging trends impacting your industry

In this example, we’re taking a closer look at one of the trends surfaced by my Emerging Trends Dashboard, which tracks AI developments in the professional services industry, specifically trends that could impact SaaS companies. The trend here is AI-powered practice management. After selecting a few relevant articles, Ask AI suggested the prompt: “What are the key benefits of AI integration in professional practice management?”, a strong starting point to explore the strategic opportunities this trend presents.

Running the prompt suggestion “What are the key benefits of Al integration in professional practice management?” on a trend picked from the Emerging Trends Dashboard.

Example 3: Stay on top of sustainability-related regulatory changes

When a story is gaining traction, you can quickly access its Insights Card by clicking the green metadata tag at the top of the article. In this example, we’re diving into a top story about the EU’s ratification of the High Seas Treaty, a development with wide-reaching implications across countries and industries. Ask AI suggested the prompt: “How many countries have ratified the High Seas Treaty so far?”, a useful starting point to generate a clear, up-to-date overview of global adoption and the treaty’s potential impact.

Running the prompt suggestion “How many countries have ratified the High Seas Treaty so far?” on a Top Story Insights Card about the High Seas EU Treaty.

Example 4 : Explore impactful consumer behaviors and market reactions

Sometimes, research calls for a deeper dive into a single article, and Ask AI makes that easy as well. When reviewing an AI Feed about Apple’s consumer behavior, one article stood out. When selected, Ask AI suggested the prompt: “Why did Morgan Stanley lower Apple’s price target?” This provided a concise summary that addressed the key question behind the article, saving time and helping quickly understand the core insight.

Running the prompt suggestion “Why did Morgan Stanley lower Apple’s price target” on a single article about Apple’s lawsuit over Siri delays.

Example 5: Power search your way through your queries

Curious about which markets your competitors are targeting next? Ask AI can help you with this too. In this case, we are using Ask AI in Power Search which is a great way to dive into one-off research queries. In this example, we ran a search on Hyundai’s recent location expansions. Ask AI instantly suggested the prompt: “What investments is Hyundai making in new manufacturing facilities?” Instead of sifting through each article manually, Ask AI gave a concise summary that pulled insights from across multiple sources, providing a clear overview in seconds.

Running the prompt suggestion “What investments is Hyundai making in new manufacturing facilities?” on Power Search tracking Location Expansions AND Hyundai Motor Company.

In short…

With the new prompt suggestions in Ask AI, getting started with your research is faster and more focused. Whether you're tracking competitors, exploring market shifts, or analyzing emerging trends, Ask AI helps you ask the right questions, and get meaningful answers, without the heavy lifting.

Turn questions into insights instantly with Ask AI

Save time, surface insights, and start your research with smarter prompts tailored to your articles.

Try Feedly Ask AI

Market Intelligence

Conducting historical searches with Feedly

Search across time, sources, and languages to unlock past insights with precision

Jay Feyerabend

on May 28, 2025

15 Second-summary

Searching through thousands of articles across the open web is already challenging, and even harder when you need to go back in time to analyze past events, track evolving narratives, or understand how competitor messaging has shifted. That’s why we built in custom time ranges into Feedly’s Search, to help analysts easily surface the most relevant and comprehensive insights from the past.

With Feedly Search, you can:

• Search across a custom time range to focus your analysis on specific periods of interest.
• Control your sources by narrowing your scope to trusted outlets or expanding to discover new ones.
• Uncover the most relevant articles within your selected time range, avoiding noise and information overload.
• Search across multiple languages to tap into global perspectives and foreign-language reporting.
• Use Ask AI to analyze selected articles, extract time-specific insights, and automate manual research tasks.

Whether you're building a quarterly report, tracking competitive shifts, or analyzing how media coverage has evolved, Feedly transforms historical research into a fast, focused, and insight-rich process.

Conducting a historical search dating back to January 2024 to analyze relevant news regarding General motors and autonomous vehicles.

Conducting historical searches can be challenging…

When you’re digging into past events, trends, or news coverage, nothing is more frustrating than hitting a wall with your search tools. Most search tools operate as a black box, without user control over the sources or time range they are searching. Whether preparing a quarterly report, tracking a story’s evolution, or gathering competitive intel from last year, limited historical search can leave gaps in your research. That’s where Feedly’s historical search capabilities come in. Designed for researchers and analysts who need to answer ad-hoc questions with precision, Feedly’s Search empowers users to dive deeper into the past and surface the insights they need.

Search across a custom time range

The custom date range selector, allows you to narrow your search to a specific time frame. This is helpful for analyzing past trends, reviewing industry coverage over a specific quarter, or compiling articles for monthly reports. To set a custom range, click the drop-down under the “Published” filter in Power Search, select “Custom Range,” and choose the start and end dates. Whether you’re tracking a news story’s evolution or curating content for a report, this feature ensures you find what you need from the right time.

Easily trace back to articles from 2024 using a custom time range.

Control your sources

Controlling where your information comes from is just as important as setting the right time range. Sometimes, you want to narrow your search to a trusted set of sources like your favorites. Other times, you might want to cast a wider net and discover new perspectives using the ‘All Web’ tab. With Feedly, you have the flexibility to do both. When using Feedly's Search, you can choose exactly which sources to include, whether it’s your go-to outlets or a broader selection. Feedly AI will then surface the most relevant articles from those sources, published within your selected timeframe.

Choose exactly which sources to search. In this example, we’re using the press Releases source bundle to explore what was published in January 2024.

Uncover the most relevant articles

Let’s say you’re looking for the most relevant articles about General Motors’ work on autonomous vehicles excluding scooters, from the first quarter of 2024. Instead of spending hours digging through the open web, Feedly’s proprietary AI Models are trained to understand thousands of market intelligence concepts and surface the articles that matter most to your specific query. Feedly Search supports advanced search operators like AND, OR, and NOT to refine results as well as the option to further tailor your searches by choosing to search all content (meaning the body of the news article) or just in article titles.

Using Feedly’s AI Models to surface highly relevant news about General Motors or Ford news and autonomous vehicles, while excluding any articles that mention scooters.

Search across multiple languages

Feedly AI supports dozens of languages, allowing you to search for articles published in any supported language within a specific time frame. This helps you uncover not only foreign-language coverage but also diverse global perspectives related to your query. And it’s easy! Just use English keywords and AI Models, and Feedly will surface relevant articles published in any language during your selected time period, automatically translated into English so you can dive right in.

Search for articles in multiple languages to uncover global perspectives and insights. These are automatically translated into English.

Use Ask AI to analyze selected articles

By now, you’ve fully personalized your research to surface the most relevant articles for your query. But what if you need to go deeper and extract actionable insights more efficiently? That’s where Ask AI comes in. Trained on market intelligence data, Ask AI can analyze up to 25 selected articles at once, performing tasks that would normally take hours manually. For example, you can prompt Ask AI to review 25 historical articles and uncover how General Motors’ messaging around autonomous vehicles has evolved over time.

Using Ask AI to discover the evolution of Ford’s messaging regarding autonomous vehicles in the last two years.

Conduct historical searches with Feedly

Search across time, sources, and languages to unlock past insights with precision.

Try for Free

FAQs

Market Intelligence

How to optimize your Emerging Trends Dashboard to surface relevant trends

Narrow in on niche trends to stay ahead of the curve

Jay Feyerabend

on May 20, 2025

Identifying emerging trends to gain a competitive edge

Identifying emerging trends early gives organizations a competitive edge to anticipate shifts in technology, consumer behavior, and market dynamics—before they become mainstream. This foresight allows proactive strategic decisions in product development, innovation, marketing, and investment. By tagging and tracking relevant trends, companies can build a 360° view of their landscape, connecting insights across R&D, strategy, and competitive intelligence. In fast-moving industries, missing an early signal can mean falling behind. With Feedly’s Emerging Trends Dashboard, organizations can stay alert to weak signals that grow into tomorrow’s big changes.

Our proprietary AI scans millions of articles to surface trends in near real-time and filter out noise. Trends are included in our dashboards, once they reach a minimum visibility threshold, meaning, the trend has appeared across a number of publications over a specific timeframe. To ensure we only include actionable trends, we filter out seasonal events like "Black Friday", specific product launches, events like conferences or sporting event, and one-off stories like elections. Now with Custom Filters, you can quickly navigate to the trends most important to you.

This blog will guide you in setting up and refining your dashboard to surface the trends most relevant trends.

Using a Custom Filter to zero in on trends that matter the most to me.

Create a new dashboard

When creating a new dashboard, start by selecting the broadest categorization of your research interest to discover a high volume of trends, like industries, technologies, sustainability topics, generations, consumer trends, or other broad topics. For example, you can start with an industry such as the energy industry.

Creating an Emerging Trends Dashboard for the energy industry.

Refine and dive deeper with a Custom Filter

If you would rather dive deeper into a specific subsection of your dashboard, you can do so with a Custom Filter. For instance, you can create a Custom Filter using your own words to specify the desired trends you wish to see. Pro Tip: This works best for dashboards about broad industries or topics. For example, an energy industry focused dashboard can be further refined to only surface nuclear power related trends by using the Custom Filter.

Adding a Custom Filter to surface trends relevant to nuclear power.

Additional refinement options

In addition to the refinements with the Custom Filter, you can also use the Growth, Time Range, and Size filters to further narrow down the list of trends.

• Time Range: The time range filter refers to the amount of time a specific trend has qualified by our definition and the filters available are last 30 days, 3 months, 6 months, and 12 months.
• Growth: The growth filter refers to the percentage increase in the number of times that specific trend has been mentioned and is categorized as “Growing, Surging, and Exploding”
• Size: The size filter refers to the number of articles and sources mentioning the trend, categorized as Niche, Known, and Mainstream.

Leveraging additional refinements to further personalize my trend research.

Zero in on the trends most relevant to you

Use Custom Filters in Emerging Trends Dashboard to fully personalize your trend research.

Try for Free

Threat Intelligence

Feedly Threat Intelligence + ThreatConnect: Enhance context in your TIP

Combine Feedly’s AI-driven insights with ThreatConnect’s powerful TIP capabilities to accelerate analysis and improve response

Shawn Jaques

on May 15, 2025

15-Second summary

Feedly’s integration with ThreatConnect simplifies and enhances threat intelligence workflows by delivering relevant, contextual intelligence directly into your TIP, enabling deeper enrichment, smarter prioritization, and alignment with intelligence requirements — all with seamless health monitoring through our no-code service app.

With this no-code integration, you can:

• Enrich your investigations with high-signal intelligence from Feedly AI Feeds and Boards.
• Ingest IoCs, CVEs, TTPs, threat actors, and malware data with context into ThreatConnect.
• Correlate Feedly and ThreatConnect data to improve threat prioritization and response.

Boost your threat research with enriched, actionable insights from Feedly and ThreatConnect.

Enrich your investigations with high-signal intelligence

Many threat intelligence platforms struggle with the quality of their open-source data. Analysts often face a flood of low-signal content, such as irrelevant or duplicative articles, indicators that lack context, or vulnerabilities unrelated to their tech stack. This noise not only slows investigations but risks burying the few pieces of truly actionable intelligence.

Feedly’s AI Feeds surface only the most relevant, high-confidence open-source intelligence from thousands of sources, filtering out noise and highlighting critical IoCs, TTPs, CVEs, malware families, and threat actors. This intelligence flows directly into ThreatConnect TI Ops as structured reports and indicators, with relationships and context preserved. Analysts can quickly enrich investigations with high-signal intelligence that integrates seamlessly with existing threat data.

Feedly article pulled into ThreatConnect showing relevant TTPs.

Ingest IoCs, CVEs, TTPs, threat actors, and malware data with context into ThreatConnect

Feedly AI automatically extracts and correlates key threat intelligence entities, such as CVEs, IoCs, TTPs, malware families, and threat actor names, from thousands of cybersecurity sources. Each article is processed into structured STIX 2.1 JSON and enriched with contextual relationships through the Feedly Threat Graph. This ensures that when intelligence is ingested into ThreatConnect, it arrives in a usable, standardized format that maintains the context necessary for effective analysis.

When Feedly identifies a relevant article containing actionable intelligence, it can automatically generate a report in ThreatConnect, complete with extracted indicators, TTPs, vulnerabilities, and linked threat actors or malware. This automation streamlines the intelligence ingestion process, reduces manual entry, and preserves the connections between entities, enabling CTI analysts to quickly pivot from high-level reporting to technical details during investigations.

Spider diagram within ThreatConnect showing TTPs and IOCs pulled in from a Feedly article.

Correlate Feedly and ThreatConnect data to improve threat prioritization and response

Once Feedly intelligence is inside ThreatConnect, it becomes part of a larger, connected threat landscape that includes additional intelligence feeds, internal telemetry, and detection systems. Using the ThreatConnect Threat Graph, analysts can correlate Feedly-sourced indicators, TTPs, CVEs, and actor profiles with internal data to reveal deeper relationships and surface hidden threats.

This correlation improves both prioritization and response. Analysts can identify whether a Feedly-sourced IoC appears in internal logs, map emerging vulnerabilities to affected assets, or connect new TTPs to known adversary behavior. By linking external insights with internal visibility, teams can make better-informed decisions and act faster against the most relevant threats.

Intelligence from Feedly can be automatically mapped to ThreatConnect Intelligence Requirements, ensuring fidelity and relevancy with your most critical intel needs.

Using ThreatConnect's PIRs feature to organize Feedly articles that align with the intelligence requirement.

Conclusion

The integration of Feedly Threat Intelligence with ThreatConnect brings automation, precision, and context to your threat intelligence workflows. It eliminates the burden of low-signal open-source data and helps analysts move efficiently from ingestion to investigation to action. With structured, contextual intelligence flowing directly into your TIP, your team can stay focused on what matters: identifying threats early, prioritizing confidently, and responding with speed.

Try Feedly's ThreatConnect integration

Simplify and enhance threat intelligence workflows by delivering relevant, contextual intelligence directly into your TIP.

Try Feedly Threat Intelligence

Market Intelligence

Unlock strategic signals from LinkedIn with Feedly Market Intelligence

Track, filter, and analyze LinkedIn posts in one place, so you never miss a strategic insight

Jay Feyerabend

on May 14, 2025

15 Second summary

Ever visited a competitor’s website hoping to uncover their latest strategic moves, only to find outdated information? This has led market intelligence analysts to turn to social media for early signals, market shifts, and predictive insights. One platform, in particular—LinkedIn—has become a go-to source for timely, business-savvy intelligence. But researching on LinkedIn can be fragmented when each team member searches individually. That’s why we’ve integrated LinkedIn feeds directly into your Feedly account, eliminating the fragmentation and ensuring you never miss real-time insights.

Following LinkedIn Feeds in Feedly allows you to:

• Follow companies and thought leaders, using custom filters to surface the posts most relevant to you.
• Analyze posts or entire feeds to uncover trends and extract data using Ask AI.
• Conduct historical searches with AI Models optimized for market intelligence.
• Share key insights with your team using Automated Newsletters, Slack and Microsoft Teams.

Simply copy paste the LinkedIn URL into Feedly to build an RSS Feed.

Please note his feature is available exclusively on Business and Enterprise plans. Start your free trial today to explore it.

I use Feedly to monitor competitive and market news, which is an essential part of our compete program at HubSpot. Their new LinkedIn integration has been great at helping us expand our coverage and stay on top of emerging trends! More and more news is happening on social media, and this helps us keep track of all that. I got it set up in less than 30 minutes, and it's greatly expanded our competitive news coverage.

Ben Conte, Senior Product Marketing Manager, Competitive Intelligence, HubSpot

Follow companies and thought leader’s feeds

As with any source in Feedly, following companies or thought leaders on LinkedIn is as simple as adding their feed URL. But what if you want to go deeper, like tracking only a CEO’s posts that mention sustainability, or surfacing partnerships and product launches shared on a competitor’s company page? That’s where Feedly AI shines. It filters out the noise and pulls in only the insights that matter to you using market intelligence optimized AI Models. This level of precision turns LinkedIn from a cluttered social feed into a focused stream of high-value intelligence tailored to your strategic priorities.

Pulling articles from LinkedIn feeds to discover news about AI partnerships.

Analyze posts or entire feeds to uncover trends and extract data

With Ask AI, Feedly does more than collect content—it helps you analyze it with one click. Once you’ve added LinkedIn posts to your feed, Ask AI can analyze them at scale. Whether you're tracking a specific thought leader, a group of executives, or your competitors’ marketing posts, you can extract the most intriguing data points, identify key themes, or create data visualizations to help you create deliverables with ease.

Using Ask AI to outline the top themes emerging in the Gen AI space.

Feedly's LinkedIn integration has streamlined my benchmark reporting. I can track all competitor updates in one place, quickly spot key launches or M&As, and easily pull insights into reports. It’s saved me hours and made sharing intel across the team effortless.

Isabo Osstyn, Product Manager, Schoeller Allibert

Conduct historical searches

Spotting the first mention of a new product line, or analyzing a competitor’s messaging over time is critical for understanding your industry. That’s why Feedly allows you to search through months of LinkedIn activity from the feeds you follow. Filter posts by date, topic, or the highest impact stories to uncover key announcements, identify strategic shifts, and build detailed reports, timelines, and executive briefings to drive action in your organization.

Use the custom range filter to analyze the posts published within that time range.

Share key insights with your team

Found a post worth sharing? Now, you can seamlessly distribute LinkedIn intelligence across your organization using Automated Newsletters or our Slack and Microsoft Teams integrations. Whether you’re feeding a weekly trend report to marketing or sharing competitive signals with your sales team, automation keeps everyone aligned. Quick tip: create a Board to centralize the most valuable LinkedIn posts, then link that Board to a newsletter and share it with your team. It’s never been easier to turn LinkedIn insights into team-wide action.

Each article in this newsletter is featuring a post pulled in from a LinkedIn feed.

Ready to try it?

Adding LinkedIn as a source in Feedly is now available to all users on Business and Enterprise plans. Just search for a LinkedIn profile, hit follow, and start unlocking insights in seconds.

Stay ahead of your market. Stay connected to thought leaders. And let Feedly do the heavy lifting.

Try Feedly Market Intelligence

FAQs

Market Intelligence

Unlock industry insights to drive smarter decisions

New AI Models tailored to your industry, helping you uncover breaking news & trends

Jay Feyerabend

on May 06, 2025

Introducing our new industry AI Models

Industry AI Models are at the core of Feedly’s AI experience—powering everything from targeted results in AI Feeds to focused insights in Emerging Trend Dashboards and contextual examples in Use Case Tables. To help you surface the most relevant and precise intelligence, we’re continually expanding our library of industry-specific AI Models.

We are releasing five new industries our customers have been asking for: packaging, professional services, accounting, consulting, and optics.

Here’s a look at the latest additions to the Feedly AI Model library powerful tools designed to help you analyze, collect, and act on the insights that matters most. In this article, we’ll explore what’s new and show you how to make the most of these AI Models.

📦 Packaging Industry

Our new Packaging Industry AI Model identifies articles related to the design, evaluation, and production of packaging across sectors. Whether you're tracking innovations in materials, packaging companies, or logistics solutions like primary, secondary, bulk, and transit packaging, this model ensures your feed is packed with the most relevant insights.

In this example, we are using the Packaging Industry AI Model within an AI Feed to filter through the open web and find the most relevant articles around strategic moves in the packaging industry.

💼 Professional Services Industry

The new Professional Services AI Model acts as an umbrella for key knowledge work sectors. It includes all the concepts from our Accounting, Consulting, and Legal industry AI Models, perfect for capturing broad trends or drilling into specialized expertise.

The example below demonstrates how to create a dashboard focused on the professional services industry. For a comprehensive overview of the Emerging Trends Dashboard and its capabilities, explore our full guide: New Emerging Trends Dashboard: Find the next big thing.

Creating an Emerging Trends Dashboard with the Professional Services AI Model. The dashboard surfaces trends affecting the professional services industry worth looking out for.

🧾 Accounting Industry

Track financial reporting, auditing, tax preparation, and accounting systems with our Accounting Industry AI Model. From forensic accounting to the latest updates from CPA firms, this model helps you stay informed on the money behind the business.

Below, we highlight our Top Stories Tab, but that’s just the beginning. If staying on top of high-impact stories in the accounting industry is a priority, this resource is for you: Monitor high-impact stories on topics of interest with ‘Top Stories’.

Using the Top Stories Tab within an AI Feed on the accounting industry to dive deep into the stories with the most significant media coverage.

🧠 Consulting Industry

Our Consulting Industry AI Model captures expert advice and strategic guidance across industries. It flags insights in areas like operations, risk, HR, finance, IT, and more. Ideal for anyone monitoring thought leadership and solution providers.

This example features Ask AI, our go-to tool for summarizing, analyze, or extracting data from articles. Upon building an AI Feed focused on generative AI in the consulting industry, we ran Ask AI on the article results using the following prompt:

Create a table listing the key use cases of generative AI in the consulting industry. For each entry, include the company name, product name, a brief description of the use case, and the product’s launch date.

Using Ask AI to create a table with key use cases of generative AI in the consulting industry.

🔬 Optics Industry

The Optics Industry AI Model focuses on technologies and companies working with the science of light. From optical components and systems to real-world applications in industries like healthcare and manufacturing, this model brings clarity to complex innovation.

Jumping into the Use Cases Tab in AI Feeds to explore how technologies like generative AI and other emerging trends are being applied and leveraged within the optics industry.

In short…

This blog highlights practical ways to use Feedly’s AI Models to personalize your research and surface only the most relevant insights from across the open web. Each example can be fully tailored to your specific needs and remember, these are just 5 out of over 10,000 AI Models available in our library.

If you want to explore more AI Models, you can do so here: https://feedly.com/ai.

Need something custom? Reach out to your CSM to request an AI Model built specifically for your use case!

Fully tailor your research to your industry

Use these these five industries or deep dive into dozens of industry AI Models.

Try for Free

Threat Intelligence

Prompt engineering: Explore CVE chaining potential

Understand how attackers can link vulnerabilities to maximize damage.

Gaby Zedan

on May 01, 2025

Overview

One vulnerability might not bring your organization down, but when chained with others, it can create critical risks, often catching defenders off guard. At Feedly, we built CVE Insights Cards to give you a complete view of critical vulnerabilities. Now, with Ask AI in CVE Insights Cards, CTI teams can dive even deeper: asking targeted questions around specific CVEs, exploring their chaining potential, and identifying hidden exploitation paths, which is exactly what this new prompt is designed to help you uncover.

This Ask AI Prompt generates detailed scenarios showing how a CVE could be chained with complementary vulnerabilities, outlines the impact of potential attack paths, maps the stages where chaining could occur, and highlights related threat actor TTPs in a structured format. It’s built to help you spot attack chains others might miss, strengthen your defenses before threat actors make their move, and stay one step ahead in a constantly evolving threat landscape.

You can save your prompt in the Ask AI library and re-run it against other CVEs to see consistent output.

Ask AI Prompt

Copy and paste this prompt directly in your Ask AI panel!

Provide a short overview of this CVE.

Give me chaining scenarios for this vulnerability, each of the scenarios with:
1. Complementary vulnerabilities that could be chained with this CVE to achieve greater impact.
2. A description of the impact of the chained attack (e.g., privilege escalation, lateral movement, remote code execution, data exfiltration).
3. An outline on the attack stages where chaining would occur (e.g., initial access, persistence, escalation).
4. Any known threat actor TTPs (Tactics, Techniques, and Procedures) that align with this chaining potential, in a table format.
5. An attack chain diagram that visually shows how the CVE could be exploited within the chained attack path.
6. Provide log sources and specific details that could aid in the detection of these scenarios
7. Any detection rules that may already exist 
8. Providing details if the chain is theoretical or has already occurred. 

Ask AI Response

Ask AI Response showing one of the scenarios created using this Ask AI Prompt.

Where is the information coming from?

Hover over the numbered bubbles in the Ask AI Response to view the exact article from which the information came.

In-line citations make answers verifiable.

In short…

Start using this prompt in Ask AI to go beyond surface-level analysis and uncover how attackers might chain vulnerabilities to compromise your environment. It’s a powerful way to turn CVE data into real-world defensive strategies.

Try Ask AI in CVE Insights Cards

Spot potential vulnerability chains before attackers do.

Start Free Trial

Threat Intelligence

Ask AI in CVE Insights Cards—precise answers for faster prioritization

Ask AI adds context-aware querying to CVE Insights Cards so you can get specific, actionable information in seconds.

Shawn Jaques

on Apr 24, 2025

15-Second summary

Assessing the real-world risk of a CVE can be time-consuming and fragmented. CVE Insights Cards provide a 360° view of each vulnerability, but sometimes, you need answers to specific questions.

We’ve added Ask AI to CVE Insights Cards so you can:

• Speed up prioritization by asking questions about how the CVE affects products, industries, or threat campaigns.
• Assess exploitability based on your criteria with custom prompts that synthesize multiple sources into responses in seconds.
• Create customized CVE reports including specific data like exploitation methods, related malware, or recommended mitigations.

With Ask AI in CVE Insights Cards, you can move from consolidated CVE overviews to precise, actionable insights faster.

Ask AI answering a custom question about a CVE on a CVE Insights Card. It provides a response with an attack chain flow diagram, threat actor details, and a table of indicators.

Overview

CVE Insights Cards offer a comprehensive view of every CVE, continuously updated with real-time information: timelines, exploit and patch data, associated threat actors, malware, and more. They’re a powerful resource for understanding a vulnerability and digging into key details like affected versions or mitigation techniques.

But even with all that data, sometimes you need more: answers to specific questions, support for a custom scoring model, or data formatted to fit your workflow. That’s where Ask AI comes in. Now integrated directly into CVE Insights Cards, Ask AI helps you extract the exact insights you need—faster and with less effort.

Speed up CVE prioritization

CVSS, EPSS, and known exploits can help gauge the severity of a CVE, but they don’t always tell the full story—especially when you’re triaging dozens of vulnerabilities. You might need to understand whether threat actors targeting your industry are actively exploiting it, or how well interim mitigations hold up while a patch is pending.

In these examples, we prompt Ask AI to summarize significant risks and then calculate a risk score based on your specified criteria. We're also showing an example regarding the chaining potential of the CVE. These prompts can be saved and reused, making it easier to apply consistent logic across multiple CVEs.

Example 1: CVE Scoring

Ask AI Prompt

You can create a custom scoring calculation to align with your company’s risk scoring methodologies. We’ve borrowed the example of a custom scoring prompt we discussed in more detail in this blog: 'Prompt engineering: Extract customized CVE scoring'

Ask AI Response

Using Ask AI to create a custom risk score on the CVE Insights Card. The response includes a table with a score breakdown and further analysis to accelerate prioritization.

Example 2: Chaining potential

Ask AI Prompt

How is this CVE chained in attacks with other vulnerabilities?

Ask AI Response

Ask AI is prompted to identify chaining implications for a CVE on a CVE Insights Card. The response details related uses of chaining, attack sequence patterns, and threat actor exploitation patterns.

Assess exploitability based on your criteria

Knowing a CVE exists is one thing; understanding how easily it can be exploited is another. Exploitability often depends on nuanced technical details buried in write-ups, proof-of-concept code, or analyst commentary. Manually gathering and interpreting that information takes time you don’t always have.

Ask AI can synthesize these sources to give you a clear, plain-language summary of exploitability. In these examples, we prompt it to explain how the exploit works, whether it requires authentication or user interaction, and how widely available the exploit code is. We've also asked Feedly AI to break down the attack chain. You can adjust the prompt to match your environment or use case.

Example 3: Technical details and exploitation requirements

Ask AI Prompt

Explain this vulnerability’s technical details and exploitation requirements.

Ask AI Response

From the CVE Insights Card, an Ask AI Expert Prompt is used to generate technical details for the specific CVE including how it is exploited and real-world exploitations.

Example 4: Attack chain

Ask AI Prompt

Create an attack chain a threat actor could use against this CVE, include a mermaid diagram and tag each step with the corresponding Kill Chain step and add MITRE t-codes where applicable.

Ask AI Response

Ask AI response is shown on the right of a CVE Insights Card. The response includes an attack flow diagram with detailed steps written below the diagram.

Create customized CVE reports

Every team has different reporting needs. You might need a quick write-up for leadership, detailed technical notes for patch management, or structured data for a risk model. Hunting through multiple sources to pull the right details into the right format can be tedious and time-consuming.

Ask AI makes it easy to generate tailored CVE reports on demand. In these examples, we ask for a customized reports for non-technical leadership in, as well as a table response on TTPs, malware, and mitigations. You can also export results or fine-tune the prompt to match your reporting format.

Example 5: Custom reports

Ask AI Prompt

Create a customized report for this CVE for non-technical leadership, providing all pertinent information relevant to share at the executive level.

Ask AI Response

Ask AI response to a prompt showing a custom report including relevant vulnerability details but catering to a non-technical audience.

Example 6: TTPs table

Ask AI Prompt

Create a TTPs, malware, and recommended mitigation table for this specific CVE.

Ask AI Response

Ask AI response on a CVE Insights Card, showing a table of related TTPs, Malware, recommended mitigations and detection methods.

Get answers, not just data

CVE Insights Cards already bring together the most important information about each vulnerability. Now, with Ask AI, you can go a step further—asking specific questions, getting tailored answers, and spending less time searching for context.

Try Ask AI in CVE Insights Cards

Start your trial for Feedly Threat Intelligence and see how much faster CVE analysis can be.

Start Free Trial

Market Intelligence

Prompt engineering: Build a report on AI agents in seconds

Use this Ask AI Prompt crafted by our Senior Research Analyst to automate report building on AI agents

Jay Feyerabend

on Apr 22, 2025

Overview

AI agents are everywhere in the headlines—but for many professionals, especially in complex industries like financial services, the real challenge is cutting through the buzz to understand what they actually do and how they can drive value. That’s the problem this Ask AI Prompt is built to solve.

Written by our Senior Research Analyst, Jay Feyerabend, it’s crafted to generate a focused, leadership-ready report that explains the fundamentals of AI agents, showcases practical use cases from peer organizations, outlines the threats and opportunities the technology poses, and maps out where the technology is headed. In a sea of hype, this is a prompt that brings clarity, context, and strategic insight to stay ahead of the latest technology.

Ask AI Prompt

Copy and paste this prompt directly in your Ask AI panel!

`<Context>
I am an innovation manager at a large financial services company and I am creating a report for leadership about AI agents.
<Context>`

`<Task>
Create a report to help stakeholders understand what AI agents are and how they can be utilized in my work.
<Task>`

`<Guidelines>
-start with an overview of the technology, what it is and what it does.
-give 2-3 case studies on how the technology is being used at similar companies in related industries.
-provide the top threats and opportunities for the financial service sector.
-finish with a conclusion outlining the future of the technology.
<Guidelines>`

Ask AI Response

We ran this prompt on a set of articles discussing the recent news about AI agents and press releases of companies introducing their new AI agents. The output generated a report tailored to the financial services industry that included an overview of the technology, two case studies of peer organizations, and concluded with the future of AI agents in the financial sector.

Ask AI response showing a detailed report on AI agents for the finance industry.

💡Remember: Ask AI is available in both your AI Feeds and Boards.

Hover over the numbered bubbles in the Ask AI Response to view the exact article where the information came from.

In-line citations make answers verifiable.

Adapt it to your use case

While this example focuses on the finance industry, the prompt is fully customizable to fit your specific needs—no matter the sector. Simply select the articles that apply to AI agents in your industry, tweak the prompt to reflect your needs or research goals, and Ask AI will generate a tailored report on AI agents that aligns with your context.

Here we’ve updated the prompt for a healthcare industry use case.

In short…

With Ask AI, market intelligence analysts can move beyond fragmented news sources and generate a comprehensive technology scouting and analysis with greater depth, accuracy, and traceability.

Try Ask AI

Quickly synthesize content and create trusted, verifiable reports.

Start Free Trial

Threat Intelligence

Prompt engineering: Generate vulnerability advisories at scale

How to create a vulnerability management report for a specific CVE in seconds

Andrew Castro

on Apr 17, 2025

Overview

Staying ahead of emerging threats requires timely and relevant intelligence and building intelligence advisories tends to be a time consuming process. Feedly’s AI Overview in Automated Newsletters enables vulnerability managers to generate customized vulnerability advisories effortlessly.

By leveraging AI Overview in Automated Newsletters, you can aggregate insights from multiple articles, ensuring your team receives concise, actionable reports on critical vulnerabilities. (Keep reading to get the full prompt).

The challenge

Vulnerability managers and cybersecurity teams need to track, analyze, and report on vulnerabilities as they emerge. However, aggregating and summarizing key details from multiple threat intelligence sources is time-consuming. Manual reporting often leads to delays, inconsistencies, and information gaps that hinder swift decision-making.

The solution

With AI Overview in Automated Newsletters, you can automate the process of generating vulnerability advisories. Feedly AI aggregates intelligence from articles saved to your Team Boards, providing a custom-structured report based on the prompt and guidelines you provide.

Adding an AI Overview to an Automated Newsletter in the editor.

Why it matters

• Saves Time – Automates intelligence gathering and report generation.
• Reduces Noise – Focuses on the most relevant details, eliminating unnecessary information.
• Improves Decision-Making – Ensures your team receives accurate, timely, and actionable intelligence.

How it works

Save Relevant Articles – As new vulnerabilities are reported, save them to your Team Board in Feedly.

Run the AI Prompt – Use AI Overview in Automated Newsletters to analyze the articles and generate a vulnerability advisory.

Distribute Intelligence – Share the AI-generated report with your security teams via automated newsletters at a regular cadence or ad hoc.

Example use case: responding to a critical CVE

Imagine a zero-day vulnerability affecting a widely used application. Security teams must rapidly understand the risk and respond effectively. Instead of manually gathering fragmented information, a Vulnerability Manager can:

• Save reports and security bulletins on the CVE to Team Board.
• Run the AI Overview prompt to generate a structured Vulnerability Advisory.
• Instantly distribute the advisory to security engineers, system administrators, and executive stakeholders.

AI Overview in Newsletters prompt

Just copy and paste this into your Automated Newsletter editor!

`Generate a Vulnerability Advisory based on the article provided. The report should include the following sections:`

`Vulnerability Advisory: [CVE ID]([https://feedly.com/i/cve/[CVE] ID])`

1. **`Executive Summary`**
    `Provide a high-level overview of the vulnerability, its impact, and any known exploitation activity.`
    
2. **`Vulnerability Details`**
    - `CVE ID & Identifiers: List the CVE ID and any relevant identifiers.`
    - `Affected Products: Specify impacted software, hardware, and versions (if mentioned).`
    - `Vulnerability Type: Describe the type (e.g., buffer overflow, SQL injection) (if mentioned).`
    - `Disclosure Information: Include the disclosure date and credit (if available).`

3. **`Description`**
    - `Summarize the root cause of the vulnerability, how it can be exploited, and the potential consequences.`

4. **`Severity & Impact`**
    - `Provide the CVSS score and severity rating (if available).`
    - `Explain potential impacts such as unauthorized access, data loss, or system compromise.`
  
5. **`Exploitation & Proof-of-Concept (PoC)`**
    - `Detail any known exploitation activity (if mentioned).`
    - `Include proof-of-concept (PoC) code or attack scenarios (if available).`
    
6. **`Mitigation & Remediation`**
    - `Outline vendor patches, updates, or mitigations.`
    - `List any temporary workarounds if a patch is not yet available.`
    
7. **`Recommendations`**
    - `Provide actionable steps for organizations to assess exposure, prioritize patching, and mitigate risks.`

How to add your AI Overview prompt

• Go to your newsletter template editor.
• Drag the AI Overview block into your newsletter.
• Customize your prompt (or paste the one in this blog).
• Pick your Folder or AI Feed to which the AI Overview applies (could also apply to all articles in the newsletter).
• Preview or Save.

To learn more about AI in Automated Newsletters, check out this blog: AI in Threat Intelligence Newsletters: Faster creation, bigger impact

AI Overview in Newsletters Result

Get Started Today

AI Overview in Automated Newsletters helps teams create vulnerability briefs automatically from the content curated in their Feeds and Boards keeping stakeholders up-to-date on the latest vulnerability intelligence.

Ready to see it in action?

Try AI Overview in Automated Newsletters today

Threat Intelligence

Further fine-tune your AI Feeds with Natural Language Filters for Threat Intelligence

Use precise queries to track niche topics, filter noise, and expand your research

Shawn Jaques

on Apr 10, 2025

15-Second summary

Feedly AI Feeds are already powerful, but what if you could fine-tune them even further? Introducing Natural Language Filters—a new way to refine your feeds with precise, natural language queries on top of our AI Models.

With Natural Language Filters, you can:

• Zero in on niche security topics
• Collect content about security-related geopolitical topics
• Extend your research deep into threat actor procedures
• Filter out articles that add noise or waste time because they lack technical details or tactical intelligence

Cut through the noise like never before—Feedly’s AI Feeds are now sharper, smarter, and more tailored to your research needs.

Using a Natural Language Filter to surface more relevant articles aligned with a niche research focus within an AI Feed.

Feedly’s AI Feeds use over 30,000+ AI Models to help teams collect intelligence that is up to seven times more relevant than keyword searches. We are introducing Natural Language Filters to refine your AI Feed even more precisely to the topics and intelligence you seek.

Zero in on niche security topics

Finding content on niche security topics often means scanning articles on related topics, only to come up empty. These rabbit hole searches waste time. Feedly’s Natural Language Filter enables you to refine a related AI Feed to retain only information related to your niche topic.

Example 1: You want to find novel uses of a TTP by threat actors targeting the finance industry. Start by setting up an AI Feed of Threat Actors targeting the Finance industry to collect TTPs. Then, add a Natural Language Filter to keep only articles about novel uses of a particular TTP.

Adding a Natural Language Filter as a layer to dive deeper into novel uses of phishing to target finance companies.

Example 2: You are interested in cyber attacks that target AWS, but are also seeing articles about attacks where threat actors use AWS in their operations. Start by creating an AI Feed with AWS and cyberattacks. Then add a Natural Language Filter to only retain articles about “cyber attacks targeting AWS”.

Using a Natural Language Filter on an AI Feed to track cyber attacks specifically targeting AWS.

Collect content about security-related geopolitical topics

Geopolitical events generate overwhelming coverage volumes. To navigate this noise and extract insights relevant to your organization, apply Natural Language Filters to precisely identify the intersection between geopolitical developments and specific security concerns.

Example 3: You’ve noticed escalating trade wars between Canada and the USA. You want to see if there are any related security issues or policy changes that have been implemented as a result in 2025.

Tracking cybersecurity policy changes in the US and Canada with AI Models and a Natural Language Filter.

Example 4: Your organization is concerned about potential risks related to China. Your leadership wants you to understand if there are any indicators of Chinese aggression towards other countries.

Tracking military movements and readiness involving Chinese (or China-allied) forces.

Research threat actor procedures

Depending on your threat landscape, adversaries, and controls, some procedures will be more relevant to understand than others. While MITRE provides information about Tactics, Techniques, and Procedures (TTPs), you might want to research aspects of specific procedures more deeply.

Example 5: Security leadership is concerned about API vulnerabilities.

Pairing multiple AI Models within an AI Feed and adding a Natural Language Filter to only feature technical reports on API path traversal to bypass access controls.

Example 6: Your organization is concerned about spearphishing. In particular, they want to understand any cyberattacks where the adversaries impersonated fintech companies.

Using a Natural Language Filter to only search for articles where adversaries are impersonating fintech companies.

Filter out articles that add noise

Natural Language Filters can also exclude content irrelevant to your research. You can set exclusions for specific topics, content types, or tonal characteristics that don't serve your analytical needs.

Example 7: Suppose you are looking for critical vulnerabilities with exploits, but you want to avoid summary information. You can use the NLP filter to exclude vulnerability rollups or summaries that don’t go into depth.

Excluding from my research articles that are summaries or don’t go into depth.

Example 8: Imagine you're looking for information about hackers targeting healthcare organizations. You want meaningful threats that could affect your organization, not every minor incident with little real-world impact.

AI Feed with a Natural Language Filter showing articles that is strictly related to attacks targeting the critical infrastructure of healthcare providers.

Final thoughts

Natural Language Filters complement rather than replace AI Models, helping to refine your AI Feeds. While AI Models typically deliver superior results, Natural Language Filters provide a precise final adjustment to sharpen your focus, particularly when an AI Model returns broader results than your specific intelligence requirements demand.

Fine-tune your Feedly AI Feeds with Natural Language Filters

Pair AI Models with Natural Language Filters to zero in on the precise intelligence you need, even for the most niche topics.

Start Free Trial

Market Intelligence

Fine-tune your Feedly AI Feeds with Natural Language Filters for Market Intelligence

Refine your research queries to target niche insights or remove noisy topics

Jay Feyerabend

on Apr 09, 2025

15 Second-summary

Feedly AI Feeds are already powerful, but what if you could fine-tune them even further? Introducing Natural Language Filters—a new way to refine your feeds with precise, natural language queries on top of our AI Models.

With Natural Language Filters, you can:

• Zero in on highly specific niche topics.
• Filter by dollar amounts, percentages, and other numerical data.
• Focus on directional relationships (e.g., which company acquired whom).
• Ensure entities are truly connected in context, not just mentioned together.

Cut through the noise like never before—Feedly’s AI Feeds are now sharper, smarter, and more tailored to your research needs.

Using a Natural Language Filter to surface more relevant articles aligned with a niche research focus within an AI Feed.

Introducing Natural Language Filters

Finding the right information in a sea of data is challenging. That’s why we’re introducing Natural Language Filters—a new way to fine-tune your Feedly AI Feeds with precise, natural language queries. Whether you need to track highly specific niche topics, filter by numerical values, or pinpoint directional relationships, Natural Language Filters give you unparalleled control over your results. Now, you can ensure the articles you surface are not just relevant but highly precise—helping you cut through the noise and focus on what truly matters.

Zero in on highly specific and niche topics

Researching niche topics can be challenging, even for the most well-crafted AI Feeds. While combining AI Models can help focus your query, the results can still be noisy. By adding a Natural Language Filter to an AI Feed, you can narrow in on articles about niche topics that are not currently supported by the AI Model library. For instance, you can create an LLM filter to surface results about specific products or models of a specific product.

Adding a Natural Language Filter as a layer to dive deeper into new first generation vehicle models being released in 2025.

You can also exclude topics from the feed by adding a “NOT” Natural Language Filter to remove unrelated content that could be cluttering your feed. For instance, you can exclude products you don’t compete against from an AI Feed that tracks competitor’s moves.

Excluding from my research articles that discuss new versions of cell phones from Google using a Natural Language Filter.

Filter by dollar amount, percentage or numerical data

While Feedly’s AI Models help analysts identify complex topics like industries, strategic moves, and companies, they were not designed to identify specific numbers or figures. However, with the new Natural Language Filters, analysts can now search for numbers as well as specify greater than and less than, percentages, or date ranges.

Pairing multiple AI Models within an AI Feed and adding a Natural Language Filter to only feature articles where startups have raised between 15M and 50M.

Focus on directional relationships

Specify the direction of transaction you care about and only surface articles that meet that criteria. For instance, you can narrow your trade search to only goods being exported from the United States into Mexico and Canada.

Tracking trade and export news in the alcohol industry with an AI Feed, filtered to highlight stories where the U.S. is exporting to Mexico and Canada.

Ensure entities are truly connected in context, not just mentioned together

Specify the exact relationship you want to see between entities in you AI Feed. Often, multiple strategic events are listed in a single article, and both entities you care about may be mentioned throughout the article but not in relation to each other. With a Natural Language Filter, you can specify exactly how you wish the entities to be connected.

AI Feed with a Natural Language Filter showing an article that is strictly related to a partnership between Honda and Toyota as specified with the NL Filter.

Final Thoughts

Natural Language Filters complement rather than replace AI Models, helping to refine your AI Feeds. While AI Models typically deliver superior results, Natural Language Filters provide a precise final adjustment to sharpen your focus, particularly when an AI Model returns broader results than your specific intelligence requirements demand.

Fine-tune your Feedly AI Feeds with Natural Language Filters

Pair AI Models with Natural Language Filters to zero in on the precise insights you need, even for the most niche topics.

Start Free Trial