Listen to this Post
Introduction:
The cybersecurity landscape is drowning in data. Every morning, security leaders at financial institutions face the same ritual: sifting through endless CVE feeds, cross-referencing CISA alerts, and manually triaging which vulnerabilities actually pose a threat to their infrastructure. Taran Douley, Founder of Shroud Labs, has built a solution that eliminates this hours-long process entirely. ShroudPredict is a live threat intelligence dashboard that consolidates four critical data sources into a single, continuously updated screen — then uses AI to synthesize everything into a plain-language executive brief, delivering in seconds what would otherwise consume a security lead’s entire first hour.
Learning Objectives:
- Understand how to integrate and consume threat intelligence from NVD, CISA KEV, AlienVault OTX, and EPSS APIs into a unified dashboard
- Learn to leverage AI (Claude) for automated vulnerability prioritization and executive briefing generation
- Master the practical implementation of a Streamlit-based threat intelligence aggregator for real-time security operations
You Should Know:
1. The Four Feeds Powering ShroudPredict
ShroudPredict ingests data from four authoritative sources, each serving a distinct purpose in the threat intelligence lifecycle:
- NIST NVD (National Vulnerability Database): The foundational feed that provides every new CVE as it’s published. The NVD API 2.0 offers structured JSON data including CVSS scores, descriptions, and affected products. With a free API key, you can achieve 50 requests per 30 seconds — critical for real-time monitoring.
-
CISA KEV (Known Exploited Vulnerabilities): This is the authoritative list of vulnerabilities actively being exploited in the wild. CISA publishes the catalog as a machine-readable JSON feed updated within minutes of catalog changes during U.S. business hours. Federal agencies are required by Binding Operational Directive 22-01 to remediate KEV-listed vulnerabilities by their due dates.
-
AlienVault OTX (Open Threat Exchange): A community-driven threat intelligence platform that provides real-time threat campaign data. The OTX DirectConnect API synchronizes threat intelligence to monitoring tools using API key authentication via the `X-OTX-API-KEY` header.
-
EPSS (Exploit Prediction Scoring System): Developed by FIRST.org, EPSS uses a machine-learning model to estimate the probability that a CVE will be exploited in the wild within the next 30 days. Scores range from 0.0 to 1.0 (0% to 100%), with the top 1% (percentile ≥ 0.99) considered extremely likely to be exploited.
2. Building Your Own Threat Intelligence Aggregator
While ShroudPredict is available for free, understanding how to build a similar system is valuable for any security team. Here’s a step-by-step guide to creating a Streamlit-based threat intelligence dashboard:
Step 1: Set Up Your Environment
Create a virtual environment python -m venv threat_intel_env source threat_intel_env/bin/activate Linux/Mac or .\threat_intel_env\Scripts\activate Windows Install required packages pip install streamlit pandas requests python-dotenv schedule
Step 2: Configure API Keys
Create a `.env` file in your project root:
NVD_API_KEY=your_nvd_api_key_here OTX_API_KEY=your_otx_api_key_here
Register for free API keys at:
- NVD: https://nvd.nist.gov/developers/request-an-api-key
- OTX: https://otx.alienvault.com/api
Step 3: Fetch NVD CVE Data
import requests
import os
from dotenv import load_dotenv
load_dotenv()
def fetch_recent_cves(days_back=7):
"""Fetch CVEs published in the last N days from NVD API"""
url = "https://services.nvd.nist.gov/rest/json/cves/2.0"
headers = {"apiKey": os.getenv("NVD_API_KEY")}
params = {
"pubStartDate": f"{(datetime.now() - timedelta(days=days_back)).isoformat()}Z",
"resultsPerPage": 100
}
response = requests.get(url, headers=headers, params=params)
return response.json()["vulnerabilities"]
Step 4: Fetch CISA KEV Catalog
def fetch_kev_catalog(): """Fetch the CISA Known Exploited Vulnerabilities catalog""" url = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" response = requests.get(url) return response.json()["vulnerabilities"] Unauthenticated endpoint
Step 5: Fetch EPSS Scores
def fetch_epss_scores(cve_ids):
"""Fetch EPSS scores for a list of CVE IDs"""
url = "https://api.first.org/data/v1/epss"
params = {"cve": ",".join(cve_ids)}
response = requests.get(url)
return response.json()["data"] Returns probability scores 0-1
Step 6: Build the Streamlit Dashboard
import streamlit as st
st.set_page_config(page_title="Threat Intelligence Dashboard", layout="wide")
st.title("🛡️ Live Threat Intelligence Feed")
Fetch data
cves = fetch_recent_cves()
kev = fetch_kev_catalog()
cve_ids = [cve["cve"]["id"] for cve in cves]
epss_data = fetch_epss_scores(cve_ids)
Display metrics
col1, col2, col3 = st.columns(3)
col1.metric("New CVEs (7 days)", len(cves))
col2.metric("Active Exploitations (KEV)", len(kev))
col3.metric("Critical (EPSS > 0.9)", sum(1 for e in epss_data if float(e["score"]) > 0.9))
3. AI-Powered Synthesis: From Data to Action
The true innovation of ShroudPredict lies in its AI layer. Taran Douley notes that “Claude synthesises all of it into a plain-language executive brief: today’s headline threat, which vulnerabilities matter for financial infrastructure, and one recommended action”. This mirrors the approach seen in other AI-powered threat intelligence platforms that use LLMs for classification and reasoning.
To implement AI synthesis in your own dashboard:
import anthropic or use OpenAI/Gemini
def generate_executive_brief(cves, kev, epss):
"""Generate an executive summary using Claude"""
client = anthropic.Anthropic(api_key=os.getenv("ANTHROPIC_API_KEY"))
prompt = f"""
You are a senior security analyst. Analyze this threat data and provide:
1. Today's headline threat
2. Vulnerabilities most relevant to financial infrastructure
3. One recommended action
CVE Data: {cves[:5]}
KEV Catalog: {kev[:5]}
EPSS Scores: {epss[:5]}
"""
response = client.messages.create(
model="claude-3-sonnet-20241022",
max_tokens=500,
messages=[{"role": "user", "content": prompt}]
)
return response.content[bash].text
- Windows and Linux Commands for Threat Intelligence Automation
For security teams looking to operationalize threat intelligence:
Linux (Cron job for daily CVE fetch):
Add to crontab for daily updates at 6 AM 0 6 /usr/bin/python3 /opt/threat_intel/fetch_cves.py >> /var/log/threat_intel.log 2>&1
Windows (Task Scheduler with PowerShell):
PowerShell script to fetch and log CVEs
$cve_url = "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=50"
$cves = Invoke-RestMethod -Uri $cve_url -Headers @{"apiKey"=$env:NVD_API_KEY}
$cves.vulnerabilities | ConvertTo-Json | Out-File "C:\threat_intel\cve_$(Get-Date -Format 'yyyyMMdd').json"
5. The Five-Tier Vision: Beyond Prediction
ShroudPredict represents only the first tier of Shroud Labs’ ambitious five-tier platform: Predict, Detect, Deceive, Respond, Share. This architecture addresses a critical gap in the cybersecurity market: mid-market financial firms that are “twice as likely as large organisations to lack adequate cyber resilience, not because they don’t care, but because they can’t out-hire banks for scarce security talent”.
The solution isn’t more headcount — it’s automation that thinks. By integrating AI-1ative capabilities across the entire security lifecycle, Shroud Labs aims to level the playing field for organizations that can’t afford a 24/7 SOC but can’t afford to be breached either.
6. API Security Considerations for Threat Intelligence Platforms
When building or integrating with threat intelligence APIs, follow these security best practices:
- Never hardcode API keys — use environment variables or secrets management (e.g., HashiCorp Vault, AWS Secrets Manager)
- Implement rate limiting to avoid API throttling and ensure reliability
- Use HTTPS exclusively for all API communications
- Validate and sanitize all incoming data before processing
- Implement proper authentication — OTX requires the `X-OTX-API-KEY` header for authenticated requests
7. Cloud Hardening for Dashboard Deployments
For teams deploying threat intelligence dashboards to the cloud:
AWS: Secure S3 bucket for storing threat data aws s3api put-bucket-policy --bucket threat-intel-data --policy file://secure-policy.json GCP: Restrict Cloud Run access to authenticated users only gcloud run deploy threat-dashboard --1o-allow-unauthenticated Azure: Enable Managed Identity for API access az webapp identity assign --1ame threat-dashboard --resource-group security-rg
What Undercode Say:
- Key Takeaway 1: The democratization of threat intelligence is here. ShroudPredict proves that enterprise-grade security tools don’t require enterprise budgets — the free tier delivers what would traditionally cost six figures in SIEM licenses and analyst headcount.
-
Key Takeaway 2: AI is not replacing security analysts — it’s augmenting them. By automating the data aggregation and initial synthesis, ShroudPredict frees security leads to focus on strategic decision-making rather than manual triage.
The genius of ShroudPredict lies in its simplicity. Four APIs. One screen. AI-driven synthesis. Taran Douley has essentially built a force multiplier for security teams that are already stretched thin. The challenge for mid-market financial firms has never been a lack of awareness — it’s been a lack of bandwidth to process the overwhelming volume of threat data. ShroudPredict eliminates that friction point entirely.
What’s particularly clever is the freemium model. By making Tier 0 free, Shroud Labs isn’t just building brand awareness — they’re creating a funnel of engaged security professionals who will provide invaluable feedback on what’s missing. As Douley states: “That conversation is worth more to me than any signup”. This is product-led growth in cybersecurity: give away the intelligence layer, build trust, and scale into detection, deception, and response.
Prediction:
- +1 ShroudPredict will trigger a wave of AI-powered threat intelligence tools for underserved markets. Expect competitors to launch similar free tiers within 12-18 months, accelerating the commoditization of threat intelligence aggregation.
-
+1 Mid-market financial firms will increasingly adopt AI-1ative security platforms as the talent shortage persists. Automation that “thinks” will become the default expectation, not a differentiator.
-
-1 The reliance on public APIs (NVD, CISA, OTX, EPSS) introduces supply chain risk. If any of these feeds experience downtime or API changes, the entire dashboard’s functionality could be compromised without proper failover mechanisms.
-
+1 The five-tier architecture (Predict, Detect, Deceive, Respond, Share) represents a comprehensive security framework that will likely become an industry standard for AI-driven cyber defense platforms.
-
-1 Mid-market firms may develop over-reliance on free threat intelligence tools without investing in the detection and response capabilities needed to act on the intelligence. Awareness without action is still a vulnerability.
▶️ Related Video (78% Match):
https://www.youtube.com/watch?v=BWtBQPTzttI
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Taran Douley – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
