# Precursor Intelligence for security teams

> Precursor Intelligence is a threat and vulnerability intelligence platform for security teams and analysts. Every CVE gets a 0 to 100 risk score from four published parts, kept up to date as the evidence changes, alongside threat-group profiles with cited evidence, attack-surface scans, a REST API and an MCP server with 71 tools. It is free to start.

Canonical page: https://www.precursorintelligence.com/for/security-teams

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact
- API documentation: https://docs.precursorintelligence.com

## How is the risk score calculated?

Four things go into it. Evidence that a flaw is being exploited counts most, then how severe it is, then how widely exposed it is and related threat activity. All of them are kept up to date for every CVE as the evidence changes.

| Part | How much it counts | What feeds it |
|---|---|---|
| Evidence it is being exploited | The biggest factor | On a government known-exploited list, seen by attack sensors, reported as used by a named group, public exploit code, the latest exploit-likelihood forecast |
| How severe it is | A strong factor | Severity rating, how easy the attack is, the type of flaw |
| How widely exposed it is | A smaller factor | How many products it affects, whether it can spread by itself, internet-of-things devices |
| Threat activity | A smaller factor | Groups and industries linked to it, whether its exploit likelihood is rising |

- **Bands:** 85 and above Critical, 70 to 84 High, 40 to 69 Medium, 20 to 39 Low, under 20 Info.
- **Exploited overrides:** anything confirmed exploited is always actioned as "Emergency patch", whatever its score.
- **Attribution is capped:** a threat group being reported to use a flaw can raise its score, but Critical needs observed or government-confirmed exploitation.
- **A ranking, not a forecast:** we do not publish an accuracy figure or claim the score predicts attacks.

See the public record for a known-exploited flaw: https://www.precursorintelligence.com/what-is/cve-2024-3400

## How much of it is actually Critical?

In a recent snapshot, about 1,200 of over 400,000 scored CVEs were Critical (under 1%). Roughly: 1,900 High, 229,000 Medium, 90,000 Low, 86,000 Info. Customers see only CVEs matched to the products they track, ranked by this score.

## What intelligence sits behind it?

Counts are rounded down, because they keep growing.

| Area | Figure | Detail |
|---|---|---|
| Vulnerabilities | Over 400,000 CVEs scored | Severity, exploit-likelihood scores and history, weaknesses, browse by vendor, product and version |
| Known exploited | Over 1,700 entries | The government list of flaws confirmed as exploited |
| Threat groups | Over 900 profiles in the app | Aliases, origin, motivation, techniques, campaigns, linked CVEs and industries; each claim has an evidence quote and source link; PDF dossiers |
| Ransomware | Over 400 groups | Over 30,000 victim claims from leak sites by sector and country, with the groups posting claims right now |
| Live exploitation | Ongoing sensor data | Attack attempts seen by internet sensors, by CVE, vendor, attacker geography and scan activity |
| Indicators | Over 350,000 IOCs | Malicious IPs, domains, URLs and hashes; over a million malware samples; SSL and JA3 blocklists |
| Attack techniques | Over 700 techniques | Tactics, techniques, a navigator, report-URL-to-technique mapping, over 1,700 emulation tests across more than 300 techniques |
| Supply chain | Over 5,300 packages | Hijacked and malicious packages from over 200 incidents across ten package ecosystems, checked against the dependency files you upload |

## What does a scan actually map?

Subdomains, hosts, IP addresses, network ranges, DNS records, open ports, running services, certificates and the known vulnerabilities on those services, grouped by host, with a network map. Compare any two scans and export either as a PDF.

- **Exposed credentials:** addresses on the domain found in third-party breaches, with record and readable-password counts. The passwords themselves are never displayed.
- **On demand:** you start each scan, on a paid plan. Running it uses no credits; unlocking the results does.
- **Discovery, not a pen test:** scans map exposure and do not exploit anything.

## Can I get it out into my own tools?

Yes. Bring findings in from the scanners you already run, send alerts to the tools your team already watches, and query everything from your own scripts or AI assistant.

- **Bring findings in:** sync from Tenable, or upload scan files from Nessus, Qualys, Rapid7, OpenVAS, Nmap and more.
- **Send alerts out:** by email, in the app or to your own webhook, with brand-protection alerts ready-formatted for Slack, Microsoft Teams, Splunk and Microsoft Sentinel.
- **Block lookalikes:** export lookalike domains as a DNS blocklist, a Microsoft 365 block list or STIX 2.1.
- **Ask your AI assistant:** connect the MCP server to Claude, Cursor or any MCP client.

**Safe to connect:** one key for the REST API and the MCP server; each key works only from the IP addresses you allow and can expire; a key only ever reaches its own organisation's data; 60 requests a minute per key on every paid plan, and calls use credits. Endpoints, scopes and limits are in the documentation: https://docs.precursorintelligence.com

## What we protect

- Two-factor sign-in is mandatory for every account, enforced on the app and every protected API route.
- Row-level isolation keeps each organisation's data apart.
- Encrypted secrets: third-party API keys and webhook secrets are encrypted.
- Stored in London: your organisation's data is stored in the UK.

## What it does not do

- No scheduled scanning: scans and the credential check run when you start them.
- No SIEM, ticketing or paging connectors: use webhooks or the API.
- No agents: it sees what is public, what you tell it and what you upload.
- No accuracy claims for the score, and no certifications claimed.

## Questions security teams ask us

### What goes into the risk score?
Four things, in order of how much they count: evidence of exploitation counts most, then severity, then exposure and threat activity. Anything confirmed exploited is always actioned as Emergency patch.

### Does the score predict which flaws will be exploited?
We do not claim that, and we do not publish an accuracy figure. It is a ranking of the evidence available today, built from the four parts described on this page and recalculated as new evidence arrives.

### Do you integrate with our SIEM or ticketing system?
There is no built-in SIEM, ticketing or paging connector. Alerts can be sent as JSON to any webhook endpoint, and the REST API and MCP server expose the same data for your own integrations.

### How is organisation data kept separate?
Every organisation's data is kept completely separate from everyone else's, enforced in the database itself. An API key can only ever reach its own organisation's data.

### Where do threat-group claims come from?
Each claim on a threat-group profile carries an evidence quote and a link to its source, so you can check it yourself. Profiles export as PDF dossiers.

### Where is data stored?
Customer data is stored in London, and each organisation's data is kept apart from every other in the database.

## Related

- IT teams: https://www.precursorintelligence.com/for/it-teams
- MSPs: https://www.precursorintelligence.com/for/msps
- Pricing: https://www.precursorintelligence.com/pricing