Exploit availability
Public capability
Example row showing how proof-of-concept, module, or detection artifacts would be separated from exploitation evidence.
artifact typesource qualityfirst-seen window
Intelligence
Predictive signals, not predictions
Hidden Intel communicates observable acceleration, convergence, corroboration, momentum, exploitation evidence, research activity, and vulnerability activity without claiming certainty about future attacks.
Limited preview
No private API connection
Live intelligence preview
A bounded presentation state showing the intelligence categories Hidden Intel can surface after authenticated access is connected.
browser → authenticated server layer → product API
LatestHotEmergingZero-daysExploitedEarly signals
Observed exploitation
Authority-backed
Example row for exploitation evidence such as canonical exploited-in-the-wild reporting or KEV-style authority signals.
confirmed sourceaffected producttimeline
Early Alert
Pre-canonical signal
Example row for security activity that may form before a complete CVE record exists.
velocitycorroborationnovelty
Observation
Normalized evidence from advisories, research, repositories, feeds, and authoritative reports.
Signal
Evidence becomes noteworthy through source quality, corroboration, velocity, novelty, or relevance.
Assessment
Transparent interpretation that explains why attention may be warranted.
Temporal intelligence
Past, Now, Next without claiming certainty
Hidden Intel organizes vulnerability intelligence by time and evidence so teams can see history, present activity, and forming signals without confusing assessment with prediction.
Past
Understand what happened and how similar vulnerabilities evolved through timelines, patterns, vendor history, product history, exploitation history, and previous signals.
precedenthistorypatterns
Now
See current vulnerabilities, zero-days, exploitation, KEV-style signals, exploit availability, Early Alerts, research activity, advisories, PoCs, IOCs, and active intelligence.
current activityevidenceexposure
Next
Identify acceleration, convergence, pre-CVE activity, increasing exploit availability, recurring patterns, emerging clusters, and unusual intelligence momentum.
accelerationconvergencesignals
Intelligence framework
Observation, Signal, Assessment
The product model keeps raw evidence, noteworthy signals, and interpretation visually distinct so teams can understand why something is appearing.
Observation
Normalized evidence from advisories, research, repositories, feeds, and authoritative reports.
Signal
Evidence becomes noteworthy through source quality, corroboration, velocity, novelty, or relevance.
Assessment
Transparent interpretation that explains why attention may be warranted.
Semantic discipline
Mandatory distinctions stay visible
The UI keeps confidence, evidence, availability, exploitation, and watch states separate so teams can act without ambiguity.
Security boundary preserved
The public preview does not call the production intelligence API, does not embed credentials, and does not expose authenticated datasets.
Watch is not exploitation
Watch states represent monitor-worthy movement with lower urgency or corroboration, never a claim that exploitation is underway.
Hot means changing quickly
Hot intelligence reflects acceleration, new corroboration, or fast-moving relevance. It is not a universal severity score.