Cyber Knowledge · Curated source ecosystem

Cybersecurity Knowledge Sources

A practical directory of authoritative guidance, original research, frameworks, tools, datasets, and hands-on learning. Every source includes an independent scope assessment, evidence-use guidance, limitations, tags, and related reading.

Explore the directory Download JSON Read the Markdown edition
165
assessed sources
32
categories
54
controlled tags
775
source crosslinks

Purpose

Choose sources for the claim or task

Quality scores describe usefulness within a source’s stated scope; they do not make every page equally authoritative. Prefer primary standards, first-party documentation, original research, or operational evidence for the claim at hand. Use practitioner and vendor material for implementation detail, then corroborate attribution, prevalence, performance, and risk conclusions when the decision requires it.

Local directory search

Find a knowledge source

Search names, organizations, descriptions, audiences, use cases, tags, formats, and keywords.

More filters

165 sources shown

Browse by domain

Category index

32 categories organize sources by their primary use.

Controlled vocabularyTag index54 tags

Choose a tag to filter the directory. Each source uses only terms from this controlled vocabulary.

A–ZQuick source index165 sources

Every entry links to a stable assessment anchor that can be shared directly.

  1. ADSecurity.org — read assessment
  2. Android Security — read assessment
  3. ANSSI France — read assessment
  4. ANY.RUN — read assessment
  5. Apache Caldera — read assessment
  6. Apple Platform Security — read assessment
  7. Arkime — read assessment
  8. arXiv Cryptography and Security — read assessment
  9. ASD Essential Eight — read assessment
  10. Atomic Red Team — read assessment
  11. Autopsy — read assessment
  12. AWS Security Best Practices — read assessment
  13. Bellingcat Online Investigation Toolkit — read assessment
  14. Binary Ninja — read assessment
  15. BloodHound — read assessment
  16. BSI Germany IT-Grundschutz — read assessment
  17. Canadian Centre for Cyber Security — read assessment
  18. capa — read assessment
  19. Center for Threat-Informed Defense — read assessment
  20. CERT-EU Publications — read assessment
  21. CERT/CC Vulnerability Notes — read assessment
  22. Check Point Research — read assessment
  23. CIS Critical Security Controls — read assessment
  24. CIS Kubernetes Benchmark — read assessment
  25. CISA ICS Advisories — read assessment
  26. CISA Known Exploited Vulnerabilities Catalog — read assessment
  27. Cisco Talos Intelligence — read assessment
  28. Cloud Security Alliance Cloud Controls Matrix — read assessment
  29. CodeQL — read assessment
  30. CrowdStrike Global Threat Report — read assessment
  31. CSA AI Controls Matrix — read assessment
  32. Cutter — read assessment
  33. CVE Program — read assessment
  34. Cyber Security Agency of Singapore — read assessment
  35. CyberDefenders — read assessment
  36. Dragos — read assessment
  37. Elastic Detection Rules — read assessment
  38. ENISA Publications — read assessment
  39. Eric Zimmerman Tools / KAPE — read assessment
  40. Exploit Database — read assessment
  41. Falco — read assessment
  42. FIRST CVSS v4.0 — read assessment
  43. FIRST EPSS — read assessment
  44. FLARE-VM — read assessment
  45. Frida — read assessment
  46. garak — read assessment
  47. Ghidra — read assessment
  48. GitHub Advisory Database — read assessment
  49. Google Cloud Security Best Practices — read assessment
  50. Google Project Zero — read assessment
  51. Google SecOps Community Rules — read assessment
  52. Google Secure AI Framework — read assessment
  53. Google Threat Intelligence — read assessment
  54. GreyNoise — read assessment
  55. GTFOBins — read assessment
  56. Hack The Box Academy — read assessment
  57. HackTricks — read assessment
  58. IBM X-Force Threat Intelligence Index — read assessment
  59. IDA Free — read assessment
  60. Israel National Cyber Directorate — read assessment
  61. JPCERT/CC — read assessment
  62. Kubernetes Security Documentation — read assessment
  63. Kubescape — read assessment
  64. LetsDefend — read assessment
  65. LiveOverflow — read assessment
  66. LOLBAS — read assessment
  67. Malpedia — read assessment
  68. Maltego — read assessment
  69. Malware-Traffic-Analysis.net — read assessment
  70. MalwareBazaar — read assessment
  71. Metasploit Documentation — read assessment
  72. Microsoft Azure Security Documentation — read assessment
  73. Microsoft Digital Defense Report — read assessment
  74. Microsoft Entra Documentation — read assessment
  75. Microsoft Sentinel Content Hub — read assessment
  76. Microsoft Threat Intelligence blog — read assessment
  77. MISP — read assessment
  78. MITRE ATLAS — read assessment
  79. MITRE ATT&CK — read assessment
  80. MITRE D3FEND — read assessment
  81. MobSF — read assessment
  82. National Vulnerability Database — read assessment
  83. NCSC AI Security Guidance — read assessment
  84. NCSC Cyber Assessment Framework — read assessment
  85. NCSC Ireland Guidance — read assessment
  86. NCSC UK Guidance — read assessment
  87. NDSS Symposium — read assessment
  88. NIST AI Risk Management Framework — read assessment
  89. NIST Cybersecurity Framework — read assessment
  90. NIST SP 800-207 Zero Trust Architecture — read assessment
  91. NIST SP 800-53 — read assessment
  92. NIST SP 800-61 Rev. 3 — read assessment
  93. Nmap Documentation — read assessment
  94. OASIS Open CTI Documentation — read assessment
  95. Open Source Vulnerabilities — read assessment
  96. OpenCTI — read assessment
  97. OpenSecurityTraining2 — read assessment
  98. OpenSSF — read assessment
  99. OSINT Framework — read assessment
  100. OSS-Fuzz — read assessment
  101. OverTheWire — read assessment
  102. OWASP API Security Project — read assessment
  103. OWASP ASVS — read assessment
  104. OWASP Cheat Sheet Series — read assessment
  105. OWASP GenAI Security Project — read assessment
  106. OWASP MASTG — read assessment
  107. OWASP MASVS — read assessment
  108. OWASP Top 10 — read assessment
  109. OWASP Web Security Testing Guide — read assessment
  110. PayloadsAllTheThings — read assessment
  111. PentesterLab — read assessment
  112. PingCastle — read assessment
  113. Plaso — read assessment
  114. PortSwigger Research — read assessment
  115. PortSwigger Web Security Academy — read assessment
  116. Promptfoo — read assessment
  117. Prowler — read assessment
  118. Purple Knight — read assessment
  119. pwntools — read assessment
  120. PyRIT — read assessment
  121. Rapid7 Vulnerability & Exploit Database — read assessment
  122. Recorded Future Triage — read assessment
  123. Red Canary Threat Detection Report — read assessment
  124. REMnux — read assessment
  125. ROP Emporium — read assessment
  126. SANS Internet Storm Center — read assessment
  127. Security Onion — read assessment
  128. Semgrep — read assessment
  129. SentinelOne Labs — read assessment
  130. Shodan — read assessment
  131. Sigma — read assessment
  132. Sigstore — read assessment
  133. SLSA — read assessment
  134. Snort — read assessment
  135. SpecterOps Research — read assessment
  136. SpiderFoot — read assessment
  137. Splunk Security Content — read assessment
  138. Stratosphere IPS Datasets — read assessment
  139. Stratus Red Team — read assessment
  140. Suricata — read assessment
  141. The DFIR Report — read assessment
  142. The Sleuth Kit — read assessment
  143. theHarvester — read assessment
  144. ThreatFox — read assessment
  145. Timesketch — read assessment
  146. Trace Labs — read assessment
  147. Trivy — read assessment
  148. TryHackMe — read assessment
  149. UNB CIC Datasets — read assessment
  150. Unit 42 — read assessment
  151. URLhaus — read assessment
  152. USENIX Security Symposium — read assessment
  153. Velociraptor — read assessment
  154. Verizon Data Breach Investigations Report — read assessment
  155. VirusTotal — read assessment
  156. Volatility Foundation — read assessment
  157. VulnCheck KEV — read assessment
  158. VX-Underground — read assessment
  159. Wazuh — read assessment
  160. Wireshark — read assessment
  161. x64dbg — read assessment
  162. YARA — read assessment
  163. Zeek — read assessment
  164. Zero Day Initiative — read assessment

Source assessments

Detailed directory

Open an assessment for detailed use guidance, quality dimensions, limitations, audiences, formats, keywords, and related sources.

Category

Academic

1 source

AcademicAssessment tier B

arXiv Cryptography and Security

arXiv

Visit source

The arXiv Cryptography and Security category is an open-access preprint stream covering applied and theoretical cryptography, systems and network security, privacy, software security, and adjacent research. It offers rapid access to new methods and results, often before conference or journal publication, with downloadable papers and revision histories. This speed makes it valuable for horizon scanning and literature discovery. arXiv moderation is not peer review, however; readers must assess methods, datasets, conflicts, revisions, and later publication status before treating any paper’s claims as established evidence.

Source type
Academic
Access
Free
Evidence use
Preprint
Maintenance
Continuous
Skill level
Advanced
Detailed assessment

Description

The arXiv Cryptography and Security category is an open-access preprint stream covering applied and theoretical cryptography, systems and network security, privacy, software security, and adjacent research. It offers rapid access to new methods and results, often before conference or journal publication, with downloadable papers and revision histories. This speed makes it valuable for horizon scanning and literature discovery. Researchers can follow subject listings or searches, inspect prior versions, trace an author’s related work, and use bibliographies to locate foundational and competing studies. For an operational decision, record the exact revision reviewed, inspect experiment design and dataset representativeness, look for released artifacts, and search for a later conference or journal version. Cross-check consequential claims against peer-reviewed venues such as USENIX Security and against independent replications or practitioner evidence. arXiv moderation is not peer review, however; readers must assess methods, datasets, conflicts, revisions, and later publication status before treating any paper’s claims as established evidence.

Strengths

  • Rapid, free access to a broad stream of current security and cryptography research
  • Preserves versions, author information, abstracts, and downloadable papers
  • Useful discovery layer for work that may later appear in peer-reviewed venues

Limitations

  • Submission and moderation do not establish peer review, correctness, or reproducibility
  • Quality and practical relevance vary substantially between papers

Best for

  • Research horizon scanning
  • Literature discovery
  • Finding preprints and author versions
  • Tracking emerging cryptography and security topics

Quality dimensions

  • Authority 3.5/5
  • Originality 4/5
  • Maintenance 5/5
  • Practical_value 4.7/5
  • Transparency 5/5

Rapid, free access to a broad stream of current security and cryptography research; principal limitation: Submission and moderation do not establish peer review, correctness, or reproducibility.

Audience

  • security researchers
  • graduate students
  • cryptographers
  • advanced practitioners

Formats

  • preprints
  • abstracts
  • pdf papers
  • source files
  • rss feeds

Keywords

  • academic
  • preprints
  • cryptography
  • security-research
  • privacy
  • open-access
  • literature-review

Link validation: Reachable · checked 2026-09-07 · HTTP 200

Category

AI Security

2 sources

AI SecurityAssessment tier A

OWASP GenAI Security Project

OWASP Foundation

Visit source

The OWASP GenAI Security Project is a community-led program publishing open guidance for securing large-language-model, generative-AI, and agentic applications. Its portfolio includes risk lists, governance material, threat-intelligence work, red-team guidance, framework crosswalks, and emerging agent-control resources. It gives application teams an accessible entry point into AI-specific failure modes and mitigations. Because publications are consensus resources in a fast-moving field, they should guide prioritization rather than substitute for architecture-specific threat modeling, empirical testing, or regulatory analysis.

Source type
Nonprofit Technical
Access
Free
Evidence use
Primary Authoritative
Maintenance
Continuous
Skill level
Beginner, Intermediate, Advanced
Detailed assessment

Description

The OWASP GenAI Security Project is a community-led program publishing open guidance for securing large-language-model, generative-AI, and agentic applications. Its portfolio includes risk lists, governance material, threat-intelligence work, red-team guidance, framework crosswalks, and emerging agent-control resources. It gives application teams an accessible entry point into AI-specific failure modes and mitigations. Because publications are consensus resources in a fast-moving field, they should guide prioritization rather than substitute for architecture-specific threat modeling, empirical testing, or regulatory analysis. Teams can use its taxonomies for initial workshops, then follow specialized guidance into data, model, plugin, supply-chain, and operational controls. Crosswalks help align AI concerns with NIST AI RMF, SAIF, or the CSA AI Controls Matrix, while red-team material can inform tests built with PyRIT or Promptfoo. Resources are freely published but differ in release cadence and maturity; record the exact edition used. Verify examples against current model providers, orchestration frameworks, authorization boundaries, and application data flows.

Strengths

  • Combines accessible risk taxonomies with practical guidance for generative and agentic applications.
  • Publishes openly through a broad practitioner community rather than a single product vendor.
  • Maintains crosswalks and specialized initiatives spanning governance, data, supply chain, and testing.

Limitations

  • Consensus risk lists simplify a threat landscape that varies materially by architecture and use case.
  • Fast publication cycles require readers to verify the version and maturity of each artifact.

Best for

  • AI application risk awareness
  • secure design reviews
  • governance crosswalks
  • AI security training

Quality dimensions

  • Authority 5/5
  • Originality 5/5
  • Maintenance 5/5
  • Practical_value 4.7/5
  • Transparency 4.5/5

Combines accessible risk taxonomies with practical guidance for generative and agentic applications; principal limitation: Consensus risk lists simplify a threat landscape that varies materially by architecture and use case.

Audience

  • application security teams
  • ai engineers
  • security architects
  • risk managers

Formats

  • risk lists
  • guides
  • frameworks
  • crosswalks
  • training resources

Keywords

  • ai-security
  • llm-security
  • agentic-ai
  • application-security
  • ai-governance
  • prompt-injection
  • secure-design
  • red-team

Link validation: Reachable · checked 2026-09-07 · HTTP 200

AI SecurityAssessment tier A

MITRE ATLAS

MITRE Corporation

Visit source

MITRE ATLAS is a public knowledge base of adversary tactics and techniques for artificial-intelligence systems, modeled in a form familiar to ATT&CK users. It connects technique definitions with real-world case studies, mitigations, and relationships that support AI threat modeling and security testing. ATLAS is especially useful when teams need a shared vocabulary for attacks against machine-learning and generative-AI workflows. It is not a compliance standard or proof that a listed technique applies to every model, deployment, or agent architecture.

Source type
Nonprofit Technical
Access
Free
Evidence use
Primary Authoritative
Maintenance
Active
Skill level
Intermediate, Advanced
Detailed assessment

Description

MITRE ATLAS is a public knowledge base of adversary tactics and techniques for artificial-intelligence systems, modeled in a form familiar to ATT&CK users. It connects technique definitions with real-world case studies, mitigations, and relationships that support AI threat modeling and security testing. ATLAS is especially useful when teams need a shared vocabulary for attacks against machine-learning and generative-AI workflows. It is not a compliance standard or proof that a listed technique applies to every model, deployment, or agent architecture. Practitioners can move from a system inventory to candidate techniques, inspect referenced case evidence, and use mitigation mappings to build review questions or emulation plans. Structured releases also support internal tooling and crosswalks with ATT&CK. The site is publicly accessible, but users should record the dataset version because taxonomy and relationships evolve. Technique presence is an analytical hypothesis: validate prerequisites, affected assets, telemetry, and impact against the actual AI stack before turning entries into detections or controls.

Strengths

  • Provides a structured, vendor-neutral vocabulary for adversarial behavior against AI systems.
  • Links techniques to case studies and mitigations that can seed threat models and exercises.
  • Uses concepts compatible with ATT&CK, easing adoption by threat-informed defense teams.

Limitations

  • Coverage follows publicly documented evidence and can lag rapidly changing AI attack patterns.
  • The knowledge base does not prescribe a complete control program or testing methodology.

Best for

  • AI threat modeling
  • adversary emulation planning
  • security control mapping
  • shared threat vocabulary

Quality dimensions

  • Authority 5/5
  • Originality 5/5
  • Maintenance 4.5/5
  • Practical_value 4.7/5
  • Transparency 4.5/5

Provides a structured, vendor-neutral vocabulary for adversarial behavior against AI systems; principal limitation: Coverage follows publicly documented evidence and can lag rapidly changing AI attack patterns.

Audience

  • ai security engineers
  • threat modelers
  • red teams
  • detection engineers

Formats

  • knowledge base
  • technique pages
  • case studies
  • mitigation mappings
  • structured data

Keywords

  • ai-security
  • machine-learning-security
  • adversary-techniques
  • threat-modeling
  • adversary-emulation
  • mitigations
  • threat-informed-defense

Link validation: Reachable · checked 2026-09-07 · HTTP 200

Category

Government

1 source

GovernmentAssessment tier A

Israel National Cyber Directorate

Israel National Cyber Directorate

Visit source

The Israel National Cyber Directorate is the government body responsible for cyber defense of Israel’s civilian sphere. Its official portal combines national policy, public and organizational guidance, CVE advisories, incident-reporting services, and reports on threats affecting Israeli organizations and critical infrastructure. The material is especially valuable for regional situational awareness and Israeli cyber-resilience practice. It is a government operational perspective, however, so users should corroborate campaign attribution and apply guidance in the context of their own jurisdiction and environment.

Source type
Government
Access
Free
Evidence use
Primary Authoritative
Maintenance
Active
Skill level
Beginner, Intermediate, Advanced
Detailed assessment

Description

The Israel National Cyber Directorate is the government body responsible for cyber defense of Israel’s civilian sphere. Its official portal combines national policy, public and organizational guidance, CVE advisories, incident-reporting services, and reports on threats affecting Israeli organizations and critical infrastructure. The material is especially valuable for regional situational awareness and Israeli cyber-resilience practice. Analysts can use its advisories to identify locally relevant exposure, its resilience guidance to inform organizational controls and exercises, and its reporting channel when an incident falls within the Directorate’s remit. Read individual publications alongside vendor bulletins, technical indicators, and other national CERT reporting; a government warning can establish official concern without by itself proving attribution or local compromise. Hebrew and English coverage may differ, so check both publication context and date before relying on a translation or summary. It is a government operational perspective, however, so users should corroborate campaign attribution and apply guidance in the context of their own jurisdiction and environment.

Strengths

  • Official source for Israeli civilian cyber-defense policy, services, and incident guidance
  • Combines strategic publications with operational advisories and a direct CERT incident-reporting channel
  • Provides region-specific context often absent from global frameworks

Limitations

  • Coverage is centered on Israel and does not replace organization-specific threat intelligence
  • Some material is published first or only in Hebrew, and automated access to the portal may be restricted

Best for

  • Israeli organizations and critical-infrastructure operators
  • Regional threat and resilience research
  • Government cybersecurity policy comparison
  • Locating official Israeli incident-response guidance

Quality dimensions

  • Authority 5/5
  • Originality 5/5
  • Maintenance 4.5/5
  • Practical_value 4.8/5
  • Transparency 5/5

Official source for Israeli civilian cyber-defense policy, services, and incident guidance; principal limitation: Coverage is centered on Israel and does not replace organization-specific threat intelligence.

Audience

  • security leaders
  • incident responders
  • risk managers
  • critical-infrastructure operators
  • Israeli residents and organizations

Formats

  • government guidance
  • security advisories
  • annual reports
  • policies
  • incident-reporting services

Keywords

  • government
  • national-cert
  • incident-response
  • critical-infrastructure
  • threat-reports
  • cyber-resilience
  • vulnerability-advisories
  • israel

Link validation: Automated access restricted · checked 2026-09-07 · HTTP 403

Category

Threat Informed Defense

1 source

Threat Informed DefenseAssessment tier A

MITRE ATT&CK

MITRE

Visit source

MITRE ATT&CK is a curated knowledge base and taxonomy of adversary behavior grounded in publicly reported real-world observations. It organizes tactics, techniques, sub-techniques, procedures, groups, software, mitigations, and data sources across enterprise, mobile, and industrial-control domains. Defenders use it as a common language for intelligence, detection coverage, hunting, assessment, and adversary emulation. ATT&CK is not a threat feed, a prescriptive control checklist, or proof of complete coverage; technique selection must be driven by relevant threats, platforms, and telemetry.

Source type
Nonprofit Technical
Access
Free
Evidence use
Primary Authoritative
Maintenance
Periodic
Skill level
Beginner, Intermediate, Advanced
Detailed assessment

Description

MITRE ATT&CK is a curated knowledge base and taxonomy of adversary behavior grounded in publicly reported real-world observations. It organizes tactics, techniques, sub-techniques, procedures, groups, software, mitigations, and data sources across enterprise, mobile, and industrial-control domains. Defenders use it as a common language for intelligence, detection coverage, hunting, assessment, and adversary emulation. Start with procedure examples and their citations, then relate relevant behaviors to platforms, data components, and the telemetry actually available in the environment. CTI teams can normalize reports to technique identifiers; detection engineers can use those mappings to frame hypotheses and tests; red teams can derive scoped emulation plans. Cross-use ATT&CK with D3FEND for defensive concepts and with validated test content such as Atomic Red Team, while retaining the source report behind every mapping. ATT&CK is not a threat feed, a prescriptive control checklist, or proof of complete coverage; technique selection must be driven by relevant threats, platforms, and telemetry.

Strengths

  • Widely adopted, evidence-referenced vocabulary for adversary tactics and techniques
  • Connects behaviors to observed procedures, software, groups, mitigations, and defensive data sources
  • Provides structured data and supporting tools for integration and visualization

Limitations

  • The matrix is not exhaustive and lags behavior that has not yet been publicly observed or curated
  • Technique-level mapping alone does not prove detection effectiveness or meaningful coverage

Best for

  • Threat-intelligence normalization
  • Detection and hunting planning
  • Adversary-emulation design
  • Communicating behavioral coverage

Quality dimensions

  • Authority 5/5
  • Originality 5/5
  • Maintenance 4/5
  • Practical_value 4.9/5
  • Transparency 4.5/5

Widely adopted, evidence-referenced vocabulary for adversary tactics and techniques; principal limitation: The matrix is not exhaustive and lags behavior that has not yet been publicly observed or curated.

Audience

  • cti analysts
  • detection engineers
  • threat hunters
  • red teams
  • security architects

Formats

  • knowledge base
  • matrices
  • stix data
  • spreadsheets
  • training materials
  • technical documentation

Keywords

  • mitre-attack
  • threat-informed-defense
  • adversary-behavior
  • ttps
  • detection-engineering
  • threat-hunting
  • adversary-emulation
  • cti

Link validation: Reachable · checked 2026-09-07 · HTTP 200

Category

Threat Research

2 sources

Threat ResearchAssessment tier A

Check Point Research

Check Point Software Technologies

Visit source

Check Point Research publishes original technical analysis drawn from ThreatCloud telemetry, malware and vulnerability research, open sources, and investigations by Check Point researchers. Its portal includes campaign reports, malware reverse engineering, vulnerability disclosures, cybercrime analysis, AI-security work, and recurring threat-intelligence summaries. The articles can supply useful indicators and implementation detail for defenders and researchers. Because the publisher is a security vendor and visibility reflects its sensors and research priorities, quantitative and attribution claims should be compared with independent reporting and primary advisories.

Source type
Commercial Technical
Access
Free
Evidence use
Primary Operational
Maintenance
Continuous
Skill level
Intermediate, Advanced
Detailed assessment

Description

Check Point Research publishes original technical analysis drawn from ThreatCloud telemetry, malware and vulnerability research, open sources, and investigations by Check Point researchers. Its portal includes campaign reports, malware reverse engineering, vulnerability disclosures, cybercrime analysis, AI-security work, and recurring threat-intelligence summaries. The articles can supply useful indicators and implementation detail for defenders and researchers. An analyst can extract hashes, domains, infrastructure, malware traits, and reported ATT&CK behaviors, then convert them into time-bounded searches or detection hypotheses rather than permanent blocklists. Reverse-engineering sections are useful for understanding execution chains and configuration formats; disclosure posts can be paired with CVE records and vendor fixes to establish remediation scope. Preserve the report date and evidence chain because indicators decay, infrastructure may be shared, and named clusters can change over time. Because the publisher is a security vendor and visibility reflects its sensors and research priorities, quantitative and attribution claims should be compared with independent reporting and primary advisories.

Strengths

  • Frequent original malware, vulnerability, campaign, and cybercrime research
  • Technical reports often include indicators, code-level findings, and defensive context
  • Broad telemetry and collaboration with vendors, CERTs, and law enforcement

Limitations

  • Telemetry and topic selection reflect Check Point’s customer base and commercial research priorities
  • Attribution and global trend claims require corroboration from independent sources

Best for

  • Malware and campaign investigation
  • Extracting indicators and TTPs
  • Vulnerability research case studies
  • Monitoring cybercrime trends

Quality dimensions

  • Authority 4.5/5
  • Originality 5/5
  • Maintenance 5/5
  • Practical_value 4.8/5
  • Transparency 3.5/5

Frequent original malware, vulnerability, campaign, and cybercrime research; principal limitation: Telemetry and topic selection reflect Check Point’s customer base and commercial research priorities.

Audience

  • malware analysts
  • cti analysts
  • incident responders
  • detection engineers
  • vulnerability researchers

Formats

  • technical articles
  • research reports
  • threat bulletins
  • vulnerability advisories
  • indicator lists

Keywords

  • threat-research
  • malware-analysis
  • reverse-engineering
  • cybercrime
  • vulnerability-research
  • cti
  • threat-reports
  • vendor-research

Link validation: Reachable · checked 2026-09-07 · HTTP 200

Threat ResearchAssessment tier A

SentinelOne Labs

SentinelOne

Visit source

SentinelLabs is SentinelOne’s public research operation, publishing investigations into malware, exploits, cybercrime, advanced persistent threats, and emerging AI-related security issues. Its strongest work combines reverse engineering with campaign context, making it useful for translating observed behavior into hunting hypotheses and detections across endpoint and cloud environments. Research articles are openly readable and frequently name authors and evidence. As with any vendor lab, collection is shaped by available telemetry and researcher access, so broad prevalence figures and attribution judgments should be independently corroborated.

Source type
Commercial Technical
Access
Free
Evidence use
Primary Operational
Maintenance
Continuous
Skill level
Intermediate, Advanced
Detailed assessment

Description

SentinelLabs is SentinelOne’s public research operation, publishing investigations into malware, exploits, cybercrime, advanced persistent threats, and emerging AI-related security issues. Its strongest work combines reverse engineering with campaign context, making it useful for translating observed behavior into hunting hypotheses and detections across endpoint and cloud environments. Research articles are openly readable and frequently name authors and evidence. Malware analysts can follow code, persistence, configuration, and command-and-control findings; CTI teams can connect those observations to infrastructure, victimology, and related reporting. Use cited samples and primary artifacts to reproduce a finding safely, and translate behaviors into telemetry requirements before drafting a hunt or rule. Treat hashes and domains as scoped pivots whose ownership and activity can change, and treat vendor actor labels as aliases until independently mapped. As with any vendor lab, collection is shaped by available telemetry and researcher access, so broad prevalence figures and attribution judgments should be independently corroborated.

Strengths

  • Detailed reverse engineering and malware research with named analysts
  • Strong coverage of endpoint, macOS, cloud, APT, and cybercrime activity
  • Connects low-level technical findings to adversary and defensive context

Limitations

  • Coverage reflects SentinelOne telemetry, investigations, and editorial priorities
  • Campaign attribution and ecosystem-wide conclusions should be checked against other evidence

Best for

  • Malware reverse engineering
  • Threat-hunting hypothesis development
  • Campaign and APT research
  • Studying emerging AI-enabled threats

Quality dimensions

  • Authority 4.5/5
  • Originality 5/5
  • Maintenance 5/5
  • Practical_value 4.8/5
  • Transparency 3.5/5

Detailed reverse engineering and malware research with named analysts; principal limitation: Coverage reflects SentinelOne telemetry, investigations, and editorial priorities.

Audience

  • malware analysts
  • reverse engineers
  • threat hunters
  • cti analysts
  • detection engineers

Formats

  • technical articles
  • malware analyses
  • campaign reports
  • conference recordings
  • research reports

Keywords

  • threat-research
  • malware-analysis
  • reverse-engineering
  • threat-hunting
  • apt
  • cybercrime
  • ai-security
  • vendor-research

Link validation: Reachable · checked 2026-09-07 · HTTP 200

Category

Vulnerability

1 source

VulnerabilityAssessment tier A

CISA Known Exploited Vulnerabilities Catalog

Cybersecurity and Infrastructure Security Agency

Visit source

CISA’s Known Exploited Vulnerabilities Catalog records CVEs for which there is reliable evidence of exploitation in the wild and supplies a required remediation action and due date. It is a high-value prioritization input because it identifies confirmed attacker use rather than theoretical severity alone. The catalog is machine-readable and continuously updated. Inclusion is binary and evidence-driven, but absence does not mean a vulnerability is safe; organizations should combine KEV with asset exposure, business impact, vendor guidance, CVSS, and predictive signals such as EPSS.

Source type
Government
Access
Free
Evidence use
Primary Operational
Maintenance
Continuous
Skill level
Beginner, Intermediate, Advanced
Detailed assessment

Description

CISA’s Known Exploited Vulnerabilities Catalog records CVEs for which there is reliable evidence of exploitation in the wild and supplies a required remediation action and due date. It is a high-value prioritization input because it identifies confirmed attacker use rather than theoretical severity alone. The catalog is machine-readable and continuously updated. Vulnerability teams can ingest the CSV or JSON into asset and ticketing workflows, match entries to products actually deployed, and elevate exposed systems whose compromise would have material impact. Each entry should lead to the cited vendor guidance, where analysts confirm affected versions, fixes, workarounds, and operational consequences. The remediation date is mandatory for covered U.S. federal civilian agencies under the governing directive; other organizations may use it as a reference, not an externally imposed deadline. Inclusion is binary and evidence-driven, but absence does not mean a vulnerability is safe; organizations should combine KEV with asset exposure, business impact, vendor guidance, CVSS, and predictive signals such as EPSS.

Strengths

  • Authoritative evidence that listed vulnerabilities have been exploited in the wild
  • Provides remediation actions, dates, and downloadable machine-readable data
  • Offers a clear operational signal for vulnerability prioritization

Limitations

  • It is not an exhaustive list of exploited vulnerabilities, and non-listing is not evidence of non-exploitation
  • Federal remediation dates are policy deadlines, not a substitute for environment-specific risk analysis

Best for

  • Risk-based patch prioritization
  • Vulnerability-management dashboards
  • Exposure reviews during active incidents
  • Tracking U.S. federal remediation requirements

Quality dimensions

  • Authority 4.5/5
  • Originality 5/5
  • Maintenance 5/5
  • Practical_value 4.7/5
  • Transparency 5/5

Authoritative evidence that listed vulnerabilities have been exploited in the wild; principal limitation: It is not an exhaustive list of exploited vulnerabilities, and non-listing is not evidence of non-exploitation.

Audience

  • vulnerability managers
  • security operations teams
  • incident responders
  • system administrators
  • risk owners

Formats

  • searchable catalog
  • csv data
  • json data
  • security alerts

Keywords

  • vulnerability-management
  • known-exploited-vulnerabilities
  • active-exploitation
  • patch-prioritization
  • government
  • cve
  • machine-readable-data

Link validation: Reachable · checked 2026-09-07 · HTTP 200

Assessment boundary

How to interpret this directory

Directory presentation updated 2026-09-09. This does not refresh the individual source assessments or their link-check dates.

Five quality dimensions

Authority, originality, maintenance, practical value, and transparency are each scored from 1 to 5. The A–C tiers are editorial judgments, not measured accuracy or independent certification. Historical numeric scores remain in the export for traceability; small score differences should not be interpreted as meaningful ranking. Read the rationale and limitations for each source. Audience levels overlap: a provider may offer both introductory and advanced material. Imported research provenance records how a source was discovered, not independent validation of its claims.

Evidence before reputation

A well-known source can still be secondary evidence for a particular claim. “Primary authoritative,” “primary operational,” “mixed,” and related labels describe how a source can support analysis—not a guarantee that every publication is correct.

Tool, training, malware, and offensive-security resources may require authorization, isolation, licensing review, or extra safety controls. Read each caution and the destination’s current terms before use.

Validation is time-bounded

URLs were checked on 2026-09-07. A reachable page can change, and an automated-access restriction is not the same as a broken link. Check current versions, supersession notices, and publication dates before a consequential decision.

This curated catalog assesses reusable knowledge providers. For references cited across all 1200km articles and guides, use the site-wide citation inventory; for the narrower set cited inside Cyber Knowledge practitioner guides, use the Cyber Knowledge source index. For correction and evidence rules, read the editorial and source policy.