Rank on evidence. Then check our working.
Precursor Intelligence is a threat and vulnerability intelligence platform for security teams and analysts. Every CVE gets a 0 to 100 risk score from four published parts, kept up to date as the evidence changes, alongside threat-group profiles with cited evidence, attack-surface scans, a REST API and an MCP server with 71 tools. It is free to start.
- Method published below
- REST API and MCP server
- Free plan, no card
How is the risk score calculated?
Four things go into it. Evidence that a flaw is being exploited counts most, then how severe it is, then how widely exposed it is and related threat activity. All of them are kept up to date for every CVE as the evidence changes.
- Bands. 85 and above is Critical, 70 to 84 High, 40 to 69 Medium, 20 to 39 Low, under 20 Info.
- Exploited overrides. Anything confirmed exploited is always actioned as “Emergency patch”, whatever its score.
- Attribution is capped. A threat group being reported to use a flaw can raise its score, but Critical needs observed or government-confirmed exploitation.
- A ranking, not a forecast. We do not publish an accuracy figure or claim the score predicts attacks. It orders work by the evidence available today.
See the public record for a known-exploited flaw: CVE-2024-3400 →
- Evidence it is being exploited Biggest factorOn a government known-exploited list, seen by attack sensors, reported as used by a named group, public exploit code, the latest exploit-likelihood forecastStrong
- How severe it is Strong factorSeverity rating, how easy the attack is, the type of flawModerate
- How widely exposed it is Smaller factorHow many products it affects, whether it can spread by itself, internet-of-things devicesModerate
- Threat activity Smaller factorGroups and industries linked to it, whether its exploit likelihood is risingStrong
Emergency patchConfirmed exploitation always means “Emergency patch”, whatever the total.
- Critical85 to 100
- High70 to 84
- Medium40 to 69
- Low20 to 39
- Info0 to 19
Critical and High together are about 3,100 flaws, 0.8% of the total.
How much of it is actually Critical?
In a recent snapshot, about 1,200 of over 400,000 scored CVEs were Critical: under 1%. That is the spread across everything we track, before it is narrowed to the software your organisation runs.
What intelligence sits behind it?
The same data feeds the score, the app, the API and the MCP server. Counts are rounded down, because they keep growing.
Every published CVE, scored 0 to 100 and kept up to date, with exploit likelihood, history and the vendors, products and versions it affects.
- 1,700+Known exploitedConfirmed in use by attackers.
- 900+Threat groupsEvery claim backed by a source.
- 400+RansomwareOver 30,000 victim claims.
- LiveExploitation sensorsAttacks seen across the internet.
- 350,000+IndicatorsMalicious IPs, domains and files.
- 700+Attack techniquesMapped to the groups that use them.
- 5,300+Supply chainHijacked and malicious packages, from 200+ incidents.
- Explore the intelligence
What does a scan actually map?
Subdomains, hosts, IP addresses, network ranges, DNS records, open ports, running services, certificates and the known vulnerabilities on those services, grouped by host, with a network map. Compare any two scans and export either as a PDF.
- Exposed credentials. Addresses on the domain found in third-party breaches, with record and readable-password counts. The passwords themselves are never displayed.
- On demand. You start each scan, on a paid plan. Running it uses no credits; unlocking the results does.
- Discovery, not a pen test. Scans map exposure. They do not exploit anything.
Can I get it out into my own tools?
Yes. Bring findings in from the scanners you already run, send alerts to the tools your team already watches, and query everything from your own scripts or AI assistant.
Safe to connect
The REST API and the MCP server share a key, with access you choose.
Each key works only from the IP addresses you allow, and can expire.
A key can only ever reach its own organisation's data.
60 requests a minute per key. Calls use credits.
Works with your tools
Sync from Tenable, or upload scan files from Nessus, Qualys, Rapid7, OpenVAS, Nmap and more.
Alerts by email, in the app or to your own webhook, with brand-protection alerts ready-formatted for chat and SIEM tools.
Export lookalike domains as blocklists for your DNS, your email filtering and your threat-intel platform.
Connect the MCP server and ask about your own exposure in plain words.
What we protect. What we don’t claim.
The checks you would make before trusting a vendor, answered up front.
How your data is protected
- Two-factor sign-in is mandatory for every account, enforced on the app and every protected API route.
- Row-level isolation keeps each organisation’s data apart in the database.
- Encrypted secrets. Third-party API keys and webhook secrets are encrypted.
- Stored in London. Your organisation’s data is stored in the UK.
What it does not do
- No scheduled scanning. Scans and the credential check run when you start them.
- No SIEM, ticketing or paging connectors. Use webhooks or the API.
- No agents. It sees what is public, what you tell it and what you upload, not the inside of your network.
- No accuracy claims for the score, and no certifications claimed here.
Four things, in order of how much they count: evidence of exploitation counts most, then severity, then exposure and threat activity. Anything confirmed exploited is always actioned as Emergency patch.
We do not claim that, and we do not publish an accuracy figure. It is a ranking of the evidence available today, built from the four parts shown on this page and recalculated as new evidence arrives.
There is no built-in SIEM, ticketing or paging connector. Alerts can be sent as JSON to any webhook endpoint, and the REST API and MCP server expose the same data for your own integrations.
Every organisation’s data is kept completely separate from everyone else’s, enforced in the database itself. An API key can only ever reach its own organisation’s data.
Each claim on a threat-group profile carries an evidence quote and a link to its source, so you can check it yourself. Profiles export as PDF dossiers.
Customer data is stored in London, and each organisation’s data is kept apart from every other in the database.
Test it against what you already know.
Create a free account, track the software you run and compare our ranking with your own. Every paid plan adds every feature, including scans, the API and the MCP server.
- Free plan, no card
- API on every paid plan
- 60 requests a minute