Black Lotus Labs (Lumen) (opens in a new tab)
Why: Lumen threat research arm; China-nexus IoT/proxy quartermaster enablement model — high value for edge/IoT defenders.
Evergreen hub Strong start
Last verified 6 September 2026
Open
Threat Intelligence Reports
Actionable intelligence to understand adversaries, campaigns and techniques. Curated, verified and designed for practitioners.
32 current resources
Best starting points
Highest starting-point strength resources in this category.
Cisco Talos blog (opens in a new tab)
Why: High-yield detection engineering research including agentic post-compromise tradecraft.
Evergreen hub Strong start
Last verified 6 September 2026
Open
CrowdStrike Global Threat Report 2026 (opens in a new tab)
Why: Annual CrowdStrike threat landscape report — adversary trends, malware families, and industry risk themes for planners and responders.
Dated artefact Strong start
Last verified 6 September 2026
Open
Showing 32 resources
Black Lotus Labs (Lumen) (opens in a new tab)
Why: Lumen threat research arm; China-nexus IoT/proxy quartermaster enablement model — high value for edge/IoT defenders.
Evergreen hub Strong start
Last verified 6 September 2026
Open
Cisco Talos blog (opens in a new tab)
Why: High-yield detection engineering research including agentic post-compromise tradecraft.
Evergreen hub Strong start
Last verified 6 September 2026
Open
CrowdStrike Global Threat Report 2026 (opens in a new tab)
Why: Annual CrowdStrike threat landscape report — adversary trends, malware families, and industry risk themes for planners and responders.
Dated artefact Strong start
Last verified 6 September 2026
Open
CTO at NCSC Substack (opens in a new tab)
Why: Olly Whitehouse (NCSC CTO) Substack — senior UK cyber perspective and pointers to useful practitioner resources.
Evergreen hub Strong start
Last verified 6 September 2026
Open
Google Project Zero (opens in a new tab)
Why: Google Project Zero researches and discloses high-impact zero-day vulnerabilities with detailed technical write-ups that inform defence and vulnerability management.
Evergreen hub Strong start
Last verified 6 September 2026
Open
Mandiant M-Trends (opens in a new tab)
Why: Mandiant’s annual M-Trends report — real-world breach findings and frontline response lessons.
Living doc Strong start
Last verified 6 September 2026
Open
Microsoft Threat Intelligence (opens in a new tab)
Why: Standing hub for identity/edge tradecraft (device-code phishing, TerminalFix, Unicode phishing).
Evergreen hub Strong start
Last verified 6 September 2026
Open
PortSwigger Research (opens in a new tab)
Why: PortSwigger Research publishes practical web-security research papers, tools and techniques used by penetration testers and application defenders.
Evergreen hub Strong start
Last verified 6 September 2026
Open
Red Canary Threat Detection Report (opens in a new tab)
Why: Red Canary Threat Detection Report — annual study of detections, ATT&CK techniques, and SOC lessons.
Living doc Strong start
Last verified 6 September 2026
Open
Red Canary threat intelligence resources (opens in a new tab)
Why: Red Canary threat intelligence resources — detection guidance, reports, and practitioner write-ups.
Evergreen hub Strong start
Last verified 6 September 2026
Open
Sygnia threat research (opens in a new tab)
Why: Trusted-infrastructure and evidence-layer tradecraft (e.g. Fire Ant / TACACS).
Evergreen hub Strong start
Last verified 6 September 2026
Open
Verizon Data Breach Investigations Report (DBIR) (opens in a new tab)
Why: Verizon DBIR — the industry-standard annual data-breach study used for risk conversations and planning.
Living doc Strong start
Last verified 6 September 2026
Open
Awesome Annual Security Reports (opens in a new tab)
Why: Curated GitHub index of annual security and threat reports — a fast way to find this year’s major publications.
Evergreen hub Solid
Last verified 6 September 2026
Open
Awesome Threat Intelligence (opens in a new tab)
Why: Curated open list of threat-intelligence feeds, frameworks and research sources — a practical starting index for building a TI stack.
Evergreen hub Solid
Last verified 6 September 2026
Open
CERT-EU Threat Intelligence publications (opens in a new tab)
Why: CERT-EU threat intelligence publications — EU institutional threat reporting and situational awareness.
Evergreen hub Solid
Last verified 6 September 2026
Open
Check Point Research (opens in a new tab)
Why: Standing CPR hub for nation-state and crimeware research (e.g. Lazarus / 0-day campaigns).
Evergreen hub Solid
Last verified 6 September 2026
Open
DFIR Report Year in Review (opens in a new tab)
Why: Annual DFIR year-in-review — practical incident response lessons and case themes from the DFIR Report team.
Living doc Solid
Last verified 6 September 2026
Open
ENISA Foresight Cybersecurity Threats for 2030 (opens in a new tab)
Why: ENISA foresight on cybersecurity threats out to 2030 — useful for long-range risk and strategy conversations.
Dated artefact Solid
Last verified 6 September 2026
Open
Fortiguard Threat Signal Report (opens in a new tab)
Why: FortiGuard Threat Signal Report — weekly Fortinet roundup of notable threats and exploit activity.
Evergreen hub Solid
Last verified 6 September 2026
Open
IBM Security X-Force Threat Intelligence Index (opens in a new tab)
Why: IBM X-Force Threat Intelligence Index — annual view of attack trends, industries hit, and attacker techniques.
Living doc Solid
Last verified 6 September 2026
Open
Palo Alto Unit 42 resources (opens in a new tab)
Why: Unit 42 research hub — threat reports, actor profiles, and vulnerability write-ups from Palo Alto Networks.
Evergreen hub Solid
Last verified 6 September 2026
Open
Rapid7 Labs (opens in a new tab)
Why: Edge persistence research plus Global Threat Landscape series.
Evergreen hub Solid
Last verified 6 September 2026
Open
Recorded Future Insikt Group research (opens in a new tab)
Why: Standing Insikt research hub (Russia initial access, DPRK IT-worker pipelines, etc.).
Evergreen hub Solid
Last verified 6 September 2026
Open
Securelist (Kaspersky) (opens in a new tab)
Why: Kaspersky’s long-running research hub for malware analysis, APT reporting and threat insights used by defenders worldwide.
Evergreen hub Solid
Last verified 6 September 2026
Open
Sophos Threat Report (opens in a new tab)
Why: Sophos annual threat report — ransomware, malware, and attacker behaviour trends for defenders.
Living doc Solid
Last verified 6 September 2026
Open
Trellix Advanced Research Center Threat Reports (opens in a new tab)
Why: Trellix Advanced Research Center threat reports — regular analysis of malware, campaigns, and emerging threats.
Evergreen hub Solid
Last verified 6 September 2026
Open
BAE Threat Intelligence Insights (opens in a new tab)
Why: BAE Systems threat intelligence newsletter — regular insights from their TI team.
Evergreen hub Useful
Last verified 6 September 2026
Open
e2e-assure Recon Review (LinkedIn) (opens in a new tab)
Why: e2e-assure Recon Review — LinkedIn newsletter covering reconnaissance themes and open-source intel.
Evergreen hub Useful
Last verified 6 September 2026
Open
HP Wolf Security Threat Insights Report (opens in a new tab)
Why: HP Wolf Security Threat Insights — annual report on malware delivery, browser threats, and endpoint risk themes.
Living doc Useful
Last verified 6 September 2026
Open
NETSCOUT Threat Intelligence Report (opens in a new tab)
Why: NETSCOUT annual threat intelligence report — DDoS, botnet, and network-attack trends from global telemetry.
Living doc Useful
Last verified 6 September 2026
Open
NSHC ThreatRecon Team (Medium) (opens in a new tab)
Why: NSHC ThreatRecon Team on Medium — regular threat research posts and campaign write-ups.
Evergreen hub Useful
Last verified 6 September 2026
Open
Team Cymru (opens in a new tab)
Why: Community-minded internet security organisation offering threat intelligence, reputation data and research for defenders.
Evergreen hub Useful
Last verified 6 September 2026
Open