EN
DeutschEnglishEspañolFrançaisItaliano

Start free Dashboard
Daily threat intelligence

Too many vulnerabilities.
Only a few matter.
We tell you which, instantly.

Last 24 hours: 713 vulnerabilities evaluated, 10 selected.

Day and night we read reports from CERTs, vendors, labs, exploit repositories and technical communities. We discard the noise and deliver only what matters, checked by an AI agent, with an alert level you can read in one second.

No card required Alerts on your products

By starting you accept the Terms · Privacy

Example infrastructure.How to read the levelThe DEFCON level is today's real one.DefenceLevel Index

Sources monitored around the clock

3,858vulnerabilities in the briefings of the last 12 months
1 in 59of those we evaluate makes it into the briefing (last 30 days)
29at DEFCON 1–2 in 12 months: real emergencies are rare

Less noise. More intelligence.

The DefenceLevel Index is public. The cyber threat level, day by day: a public reference that professionals and the press can consult and cite.
Open the DefenceLevel Index →

How it works

You don't need more news.
You need more selection.

The service works for you, from collection to delivery. Nothing to install, nothing to configure.

Collection

Every 30–60 minutes we read hundreds of sources: NVD, the CISA catalogue, vendors, CERTs, research labs, GitHub, Mastodon and Bluesky.

Verification

Every report is checked against official sources. Nothing is sent without the go-ahead of an AI agent, which stops false alarms.

Selection

Four factors: severity, real-world exploitation, impact on widely used systems, specialist attention. Only what crosses the threshold passes.

Delivery

Every day at 05:00 UTC, the briefing by email. Immediate alerts: DEFCON 1 always, DEFCON 2 and 3 as you choose in My Defence.

The DEFCON level

In one second you know whether to act
or finish your coffee.

DEFCON stands for DEFense readiness CONdition.
We use the original military scale: the lower the number, the more serious the situation.

5 Low risk No serious vulnerabilities in widely used products in the last 24 hours. No urgency: routine maintenance.
4 Moderate risk Serious vulnerabilities in widely used products, with no attacks under way. Update the affected products in your normal cycle.
3 Substantial risk Attacks under way or imminent on widely used products. Immediate alert on your products in My Defence. If you use the products under attack, update them now.
2 Severe risk Broad-impact threat: an attack campaign or near-universal systems. Immediate alert. Check now whether it affects you, and update.
1 Critical risk Mass exploitation of a critical flaw in near-universal systems. Immediate alert. Mass attacks under way: act now.
Live Nov 10, 2026 · 14:25 UTC
2
Severe risk
Check now whether it affects you, and update.
9 vulnerabilities actively exploited
5 · low1 · critical
Reports collected in the last 24 hours1,907
Vulnerabilities evaluated by our analysis system713
Discarded after evaluation703
Vulnerabilities selected now10
NVDCISA KEVGitHubCERT-EUExploit-DB+44 sources

Real data from the last 24 hours, updated every 30 minutes.DefenceLevel Index

The briefing

Six sections.
Three minutes to read.

Summary

The state of the day in a few lines, with the level up front.

New in the last 24 hours

For each one: severity, impact, exploit status, what to do and why it matters now, with the sources from the last 24 hours. In your dashboard you also see why we selected it.

Still ongoing

Those already reported, with nothing new in the last 24 hours: one line each, for 3 days after the last news.

Other exploited vulnerabilities

The other exploited vulnerabilities in the news, one line each: to see at a glance whether you use those products.

Worth watching

Below the alert threshold, but worth following. If they get worse, the briefing flags it and, when needed, an immediate alert.

Much discussed, but no cause for alarm today

The widely discussed stories that, once verified, do not justify alarm. Knowing what to ignore is worth as much as knowing what to do.

Excerpt from the briefing of Nov 9, 2026 · 04:00 UTC
DEFCON 2 · Severe risk
Check now whether it affects you, and update.
DEFCON 2 · Severe risk · CVSS 8.1
OpenBSD OpenSSH: authentication bypass
Why now: The level rises from DEFCON 3 to DEFCON 2: on 8 November at 15:44 UTC SANS ISC reported scans searching for servers exposed to this flaw. VulnCheck KEV has listed it as exploited since 6 November.
  • 8 Nov, 15:44 UTC · SANS ISC: technical analysis
Exploitation confirmed by VulnCheck KEV since 6 November, citing watchTowr and previdian.com; Help Net Security also reports attacks, and The Hacker News reported attackers gaining root on a honeypot. Not in the CISA KEV catalogue.
Code on GitHub since 5 November, from unverified repositories.
Impact: On Linux systems where sshd is built with musl libc and without PAM, such as Alpine Linux, a remote attacker without credentials can log in with password authentication by sending any password between 256 and 1024 characters, for some account configurations.
Exploit: Exploited in the wild
What to do: On Linux systems that use musl libc without PAM, update OpenBSD OpenSSH to 10.6p2 or later, or to your distribution's package that carries the fix, now; until then, disable password authentication in sshd. Review successful password logins since 5 November for signs of compromise.
Why it is here: CVSS 8.1 · Active exploitation reported by VulnCheck KEV · Exploitable remotely without credentials, but only under specific conditions · Component present almost everywhere
CVE-2026-123158

Real data: the first vulnerability in the November 9 briefing, exactly as subscribers received it. Today's briefing is for subscribers only.

My Defence

Your infrastructure.
Your alerts.

Draw the zones of your network and add the products you use: the briefing and the alerts tell you at once what concerns you.

Draw your zones

Perimeter, servers, cloud, workstations: your network as it really is, with the names you use.

Add your products

Vendors and products from the catalogue; if a name is missing, you type it in.

Get what concerns you

Alerts on your products, and the briefing every day or only on the days that concern you. DEFCON 1 always reaches everyone.

Example: two items out of six concern the products in your zones.

Built for

People responsible for real systems,
with no time to waste.

Developers

You know when a dependency you use becomes a problem, before it becomes one for your users.

Sysadmins and DevOps

Firewalls, VPNs, mail servers, collaboration platforms: whatever is exposed to the internet comes first.

Every business

Without a security team, it tells you when to call your IT provider. With one, it shows where to start each day.

Consultants and MSPs

One verified source to start from every day, for every client you look after, instead of hundreds of bulletins.

Pricing

One plan. Everything included.

7 days free to see how it works.

  1. TodayStart with your email, no card.
  2. For 7 daysThe full service, no limits: try it with your real products.
  3. On day 7You decide. To continue, add a card from your dashboard; without one, the trial simply ends.

Secure payment with Stripe · Cancel anytime

€49 per month

VAT included

  • Briefing in your inbox every day at 05:00 UTC
  • Immediate alerts, also at DEFCON 3 on your products
  • Dashboard with briefing archive
  • Nothing to configure, no commitment

By starting you accept the Terms · Privacy

Any other questions? Read the FAQ

Questions

Before you start

Do I need to set anything up?

No. Enter your email, start the trial and the next day you receive your first briefing. The service never accesses your systems.

Where does the information come from?

NVD and cve.org, the CISA KEV, VulnCheck KEV and ENISA EUVD catalogues of exploited vulnerabilities, EPSS, GitHub advisories, bulletins from vendors such as Microsoft, Google, Mozilla, Atlassian, Siemens and GitLab, national CERTs in Europe, the United States, Canada and Australia, independent research labs, Exploit-DB, Metasploit, Nuclei and the main technical communities.

How do you decide what matters?

Every vulnerability is scored on four axes: technical severity, real-world exploitability, impact on widely used systems, attention from specialists. A widely discussed story without official confirmation never raises the level: it goes into the noise section, with our assessment.

Do you use artificial intelligence?

Yes. Before sending, an AI agent checks every briefing and every alert against our data: it corrects wrong attributions, stops alerts that the data do not confirm and writes their texts. Nothing goes out without its go-ahead. The DEFCON level, on the other hand, is calculated only by explicit, verifiable rules, described in the public methodology: given the same data, the result is always the same.

Why is DEFCON 1 the most severe level?

It is the original military scale the term comes from: DEFCON 5 means normal, DEFCON 1 maximum alert.

How do I cancel?

From your dashboard, in two clicks. The trial needs no card: if you do not add a payment method, it simply ends, with no charge. If you cancel an active subscription, access stays until the end of the month already paid.

Is VAT included? What about businesses?

For individuals the price is €49 a month including VAT, wherever you are. Businesses with a VAT number pay €49 without VAT when the reverse charge applies: just enter your VAT number at checkout. In all other cases VAT is already included in the price. Every payment comes with an invoice.

Tomorrow, your first briefing.

7 days free. Nothing to configure.

The briefing goes out every day at 05:00 UTC.