Collect
Normalize public and private-source evidence into consistent intelligence objects.
Product
An intelligence workspace for security teams
Hidden Intel is structured around evidence, signals, and assessments so vulnerability and threat activity can be understood in operational context.
Product model
Built around evidence and attention
Hidden Intel is designed for operational security teams who need to explain why an item moved and what to do next.
Corroborate
Evaluate source quality, velocity, novelty, recurrence, and relevance.
Prioritize
Surface items with transparent reasons rather than collapsing context into one opaque score.
Act
Route attention through watchlists, assets, saved searches, alert policies, briefs, and API workflows.
Capabilities
A full intelligence workspace, phased behind access and entitlements
Capabilities are designed for production use, with gated, preview, and planned states supported in the interface until backend integration is complete.
Vulnerability Intelligence
Context for vulnerability activity, history, severity drivers, and product relevance.
Exploitation Intelligence
Clear distinction between observed exploitation and exploit availability.
Exploit Availability
Public capability signals such as PoCs, exploit code, modules, and detection templates.
Zero-Day Monitoring
Zero-day status follows backend semantics and is never inferred from exploit code alone.
Early Alert Signals
Security signals that may exist before a complete canonical CVE record.
Emerging Threat Intelligence
Corroborated clusters forming across independent sources and source types.
IOC Intelligence
Indicator context designed for authenticated workflows rather than anonymous bulk exposure.
Vendor & Product Intelligence
Vendor, product, and family movement with history and recurrence context.
Threat Landscape
A broader view of acceleration, momentum, exposure, and intelligence movement.
Watchlists
Tracked products, vendors, topics, and vulnerabilities for focused monitoring.
Asset Exposure
Exposure-aware context for assets and products that matter to the organization.
Saved Searches
Reusable intelligence queries for recurring analyst and vulnerability workflows.
Alert Policies
Policy-driven notifications for threshold, signal, and entitlement-aware events.
Intelligence Briefs
Briefing-style summaries with evidence, signal, and assessment separation.
API Access
Server-side integration path for authorized customers and internal products.
Premium RSS / feeds
Curated intelligence delivery for authenticated and entitled use cases.
Semantic discipline
Mandatory distinctions stay visible
The UI keeps confidence, evidence, availability, exploitation, and watch states separate so teams can act without ambiguity.
Security boundary preserved
The public preview does not call the production intelligence API, does not embed credentials, and does not expose authenticated datasets.
Watch is not exploitation
Watch states represent monitor-worthy movement with lower urgency or corroboration, never a claim that exploitation is underway.
Hot means changing quickly
Hot intelligence reflects acceleration, new corroboration, or fast-moving relevance. It is not a universal severity score.
Pulse
Intelligence command center
Designed to show current priority, recent activity, observed exploitation, exploit availability, Early Alerts, emerging clusters, watch signals, IOC movement, and vendor/product movement.
Limited preview
No private API connection
Live intelligence preview
A bounded presentation state showing the intelligence categories Hidden Intel can surface after authenticated access is connected.
browser → authenticated server layer → product API
LatestHotEmergingZero-daysExploitedEarly signals
Exploit availability
Public capability
Example row showing how proof-of-concept, module, or detection artifacts would be separated from exploitation evidence.
artifact typesource qualityfirst-seen window
Observed exploitation
Authority-backed
Example row for exploitation evidence such as canonical exploited-in-the-wild reporting or KEV-style authority signals.
confirmed sourceaffected producttimeline
Early Alert
Pre-canonical signal
Example row for security activity that may form before a complete CVE record exists.
velocitycorroborationnovelty
Locked by entitlement
Premium feeds, API access, and custom webhooks show upgrade states instead of failing silently.
No exposure selected
Customer assets are sensitive and are not represented with fabricated inventory in this phase.
Loading state
Connection unavailable
A production integration error should preserve context and provide a safe retry path.
Why this appears
source qualitycorroborationvelocityrelevance
Do not merge
exploit availabilityobserved exploitationzero-day statuswatch state
Action states
monitortriagebriefpolicy alert