Threat intelligence

New CVEs every day. Which ones are about you?

LogPulse links known exploited vulnerabilities and threat feeds to your own logs. You see which CVEs affect your systems, whether a tested rule watches for abuse, and what was already in your data before anyone knew to look.

  • Security monitoring on the Free plan
  • No credit card
  • No rule goes live without human review
  • EU-hosted, GDPR by default
AdvisoryExample
CVE-2026-xxxxx · on CISA KEV
Web server package in two of your container images
  1. 1
    Known
    Listed as exploited in the wild
  2. 2
    About you
    Found by your scans in 2 images
  3. 3
    Detected
    Rule tested on an attack and a benign case, reviewed by a person
  4. 4
    Looked back
    Rule ran over the past 7 days: no hits

What is going on

Updated: November 2026

Four public facts, each with its source. Together they explain why nobody keeps up with this by hand.

48,185

CVEs published in 2025, a record.

Source: Jerry Gamblin, via The Stack
CVSS 10

GitLab flaw that CISA flagged as actively exploited on 29 October 2026. Attackers tried it against Alpine Linux, among others.

Source: The Hacker News
€200–250m

in revenue Ahold Delhaize expects to lose to the cyberattack of October 2026.

Source: Computable
1,200+

web shops attacked by AI agents in October 2026, at about $50 per successful hack.

Source: The Hacker News, Reuters

None of this calls for panic. It calls for knowing which of these vulnerabilities are in your environment, and seeing it in your logs when someone tries to use one.

From CVE to detection

Four steps from a new vulnerability to your own data

The LogPulse Intelligence Hub does the legwork centrally. Your environment answers the one question that matters: does this affect me?

  1. 1

    Known

    The hub follows CISA KEV, EPSS, NVD and threat feeds such as abuse.ch, Spamhaus and AlienVault OTX, refreshed several times a day. A CVE gets a rule when it is being exploited, is likely to be (EPSS 0.1 or higher), or affects a product a customer runs.

  2. 2

    About you

    Send your vulnerability scans and LogPulse keeps track of which CVEs are present on your systems. A match becomes an advisory in the app; for exploited or critical ones you also get an email.

  3. 3

    Detected

    Agents draft the rule and its tests. It is only published after a person reviews it and it passes on an attack case and a benign case. More than 3,000 Sigma rules first run silently, so you see which ones stay quiet in your environment before you switch them on.

  4. 4

    Looked back

    A feed often lists an IP only after the attack. Retro-hunt checks up to 30 days of your logs for newly listed IPs and runs every new rule over the past 7 days. Findings are labelled Retro.

Start free

Security monitoring and advisories are part of the Free plan.

Many of this month's breaches started with a sign-in

Denmark's population register leaked through a former employee's account with the password 123456. At ASOS it was a stolen employee login. The SafePay ransomware group got into more than 600 organisations with stolen passwords, brute force and phishing.

Source: CM-Alliance, October 2026 roundup

LogPulse does not replace MFA or a password policy. It shows when a sign-in doesn't add up, so you notice when one of those measures fails.

What LogPulse picks up on sign-ins

  • Brute force and password spraying against your accounts
  • MFA fatigue (push bombing) and MFA being switched off
  • Sign-ins from IP addresses on threat feeds
  • An account that suddenly gets an admin role
  • Sign-ins over legacy authentication, which bypasses MFA

Works with, among others

  • Microsoft Entra ID
  • Microsoft 365
  • Okta
  • Windows Security
  • Linux (sshd)
  • FortiGate
  • Palo Alto
  • pfSense

Attackers use AI. Your defence can too, with a person in charge.

In October, attackers set AI agents loose on more than 1,200 web shops to plant a web shell. LogPulse recognises web shell payloads and probing of admin endpoints, among other things, uses AI for the work that slows defenders down, and leaves decisions with people.

AI triage

The AI Investigator gathers context for a finding and drafts a verdict, so an analyst starts with the evidence instead of an empty search bar.

Propose, then approve

Agents propose rules, tuning and actions. Nothing changes until someone with the right role approves it, and every step is in the audit log.

Agents are watched too

Built-in detections flag unusual agent behaviour, such as an abnormal volume of MCP calls or an agent that makes a change.

How to start

Three steps. The first two are enough for detections and threat-feed enrichment; the third adds the view of which CVEs are on your systems.

  1. 1

    Create a free account

    No credit card. You get 1 GB of logs a day with security monitoring switched on.

  2. 2

    Connect a log source

    Start with what leads to your systems: firewall, VPN, identity provider or servers, via the LogPulse agent or the HTTP API.

  3. 3

    Send your scans (optional)

    Send the JSON output of Trivy, Grype or Snyk. LogPulse matches it against known exploited CVEs and shows an advisory when one applies to you.

Start free. Add Detection Lab when you need it.

The Free plan includes security monitoring, threat-feed enrichment and advisories, with 1 GB of logs a day and 7 days of retention. Detection Lab and the NIS2 and ISO 27001 coverage report come with Pro (€59 a month) and Business.

Covered by NIS2? The coverage report in Pro and Business is a printable overview of your detection coverage for NIS2 and ISO 27001. More on NIS2

Larger organisation or MSP? Book a demo

Questions

Does this replace my MFA, EDR or patching?
No. LogPulse shows what happens in your logs: who signs in and from where, and whether someone is trying to abuse a known vulnerability. That is how you notice when one of those measures fails or isn't rolled out yet.
Do I need a vulnerability scanner?
For the view of which CVEs are on your systems, yes. LogPulse matches CVEs against the scan results you send, for example from Trivy, Grype or Snyk. Without scans you still get advisories, threat-feed enrichment, detections and retro-hunt.
Does AI publish detection rules on its own?
No. Agents draft rules and tests. A rule is only published after a person reviews it and it passes on at least one attack case and one benign case.
How current is it?
Threat feeds refresh hourly, CISA KEV and NVD several times a day, and EPSS daily. Which CVEs are on your systems is recalculated every six hours.
What does the hub learn about me?
Only anonymous counts, such as how many customers run a product or saw a known indicator. Never your logs, events or organisation name. Your log data stays in the EU.
What does it cost?
The Free plan costs nothing: 1 GB of logs a day and 7 days of retention. Pro is €59 a month for 10 GB a day, 60 days of retention and Detection Lab. Business is €199 a month for 50 GB a day and 90 days of retention. More volume or a dedicated environment is by arrangement.

Find out which threats are about you

Connect your first log source and see what LogPulse finds. Free, no credit card.