Threat Radar

Threat Radar is a set of continuous intelligence plugins that watch external threat sources and correlate what they find against a customer's own attack surface. Each plugin produces a verdict card, a plain reading of whether the organisation is exposed to that specific class of threat and what the exposure looks like right now.

The premise is simple. Attackers rarely start from scratch. They succeed by reusing and sharing information that already exists: leaked credentials, breach dumps, infostealer logs, and vulnerabilities that are already being exploited in the wild. Threat Radar treats that same shared intelligence as a first-class input, so validation reflects what an attacker already holds, not only the technical weaknesses on the box.

Why it matters

A weakness that no attacker knows about behaves very differently from a weakness that is already circulating with a working exploit, or a credential that is already sitting in a stealer log. Threat Radar closes that gap. It brings the attacker's own resources into view and lines them up against the assets Aether AI has discovered, so a risk owner can see not just what is technically possible but what is realistically in play.

Because the intelligence is correlated to the surface rather than delivered as a raw feed, the output stays specific to the organisation. A verdict card speaks to the customer's domains, identities, and technologies, not to the threat landscape in the abstract.

How it works

Each plugin monitors a particular source, matches it against the discovered attack surface, and renders a verdict card. When a plugin has something to report, it raises findings that land in the Risk Inbox alongside everything else, labelled by source (for example "Plugin (Infostealer)"), so intelligence-driven exposure sits in the same queue as ASM and pentest findings.

The plugins

• Infostealer Monitor correlates compromised credentials from infostealer and stealer-log feeds against the surface, surfacing credentials that are already exposed.
• CISA KEV Watch tracks known-exploited vulnerabilities (the CISA Known Exploited Vulnerabilities catalogue) and flags where the surface intersects vulnerabilities that adversaries are actively exploiting.
• Breach, ransomware, dark-web and supply-chain monitors apply the same pattern to breach data, ransomware activity, dark-web mentions, and supply-chain exposure. These extend the Threat Radar family as Aether AI builds it out, rather than describing a fixed, complete catalogue.

Continuous plugins run continuously against their sources. They do not advertise a fixed run frequency in the interface, because the value is in the standing verdict rather than in a schedule.

Two-way intelligence

Threat Radar feeds work in both directions. On the defensive side, a plugin surfaces exposure as findings and alerts, so the organisation learns about a leaked credential or an actively exploited vulnerability as soon as the correlation is made. On the offensive side, the same intelligence enriches Aether AI's validation, so an attack reflects what an adversary would already have in hand rather than starting cold.

What you see and do

Threat Radar lives as verdict cards, one per plugin, correlated to the current surface. When a card reports exposure, the underlying findings flow into the Risk Inbox with a plugin source label, feed the asset risk score, and are available to remediate like any other finding. Because the plugins are continuous, the cards stay current as sources change; there is no run to schedule and no report to request.

Related