Build Your Export

Pick what you want to follow, narrow it down, then preview the actual records before you download them. One-time CSV and JSON downloads need no e-mail and no account. Save the configuration if you want a daily summary or scheduled API retrieval. Nothing you choose here changes the ICHI score.

Step 1 · What do you want to follow?

Global pressure indicators

Two daily snapshots ICHI measures for the whole Internet. They are the same for everyone: they are not a measurement of your own exposure, and your choices below never filter or recalculate them.

Edge PressureAttacker activity against firewalls, VPNs, gateways and other perimeter products: how many active findings have exploitation, post-exploitation or probing observed. Patch PressureHow hard defenders are being pushed to patch: the share of recent high and critical CVEs with a published fix, and the Remediation Pressure level. Two separate measures.

Intelligence records

Vulnerabilities and CVEsEvery CISA KEV entry, ICHI research finding and critical-threat event, one record per CVE. You choose vendors, products, CVEs, severity or KEV status next. Confirmed exploitationCVEs whose exploitation is established by CISA KEV or another governed source — not a proof-of-concept or probing alone. Security incidentsConfirmed and reported incidents at named organisations: regulator filings, the organisations' own statements and newsroom reports. Industry incident intelligenceThe same incidents, followed by industry (healthcare, finance, education…). No product match is needed. Provider outagesDisruptions on cloud and SaaS providers' own status pages, with their updates and resolution. An outage is never evidence of a cyberattack. No industry match is needed. Individual intelligence feedsFollow specific sources (for example Microsoft MSRC, CISA advisories or a state attorney general). Only feeds ICHI may redistribute can be chosen.

Threat actors and ransomware activityNot exportable: ransomware leak-site claims come from trackers whose terms do not allow ICHI to redistribute them, and they are unverified. View them on ICHI instead: Ransomware ecosystem · Incident claims · Actor dossiers.

Ready-made datasets (ICHI's own recorded measurements, no selection needed)

VECTORS daily index history — CSV · JSON
7 / 30 / 90-day comparisons — CSV · JSON
Confirmed and reported incidents, last 30 days — CSV · JSON

Field definitions, rights and what each dataset excludes: Data & exports documentation.

Step 2 · Narrow it down

Start typing to search the values ICHI's records actually contain. Within one field, choices are combined with OR. Remove a choice with its × button.

Additional intelligence feeds (advanced: follow individual sources) none selected

Every source ICHI's registries list, grouped by kind, each with whether ICHI may export it and why. Only feeds marked Available for export can be chosen. A record appears when any chosen feed is one of its own sources.

Search feeds Show available feeds only Only feeds with current records

Period and changes

Historical period

Judged on the source's own date (publication, or the provider's start time), else when ICHI first observed the record. Undated records are never given a date.

Daily delivery includes: new records materially updated records withdrawn records

This applies to daily summaries and API deltas. A one-time download is the full extract.

Step 3 · Preview and export

Preparing the preview…

Download now (free, no e-mail, no account)

Up to 10,000 records per download. Each record keeps its source names and links, dates, evidence status and why it matched.

Share this view (a link with these filters only)

The link opens this same public preview for anyone. It holds only the filters: never an e-mail address, a token or a key.

Keep in My Intelligence (this browser only)

Keeps this configuration on this device so My Intelligence can show what changed since your last visit and download it again. Nothing is sent to ICHI and no e-mail is needed.

Name

Open a saved configuration

Privacy: ICHI keeps no account and sets no tracking cookie. A saved configuration stores your choices and, only if you give one, an e-mail address used for the daily summary after you confirm it. Tokens and keys are stored only as hashes. Delete a saved configuration at any time from its management page. Subscribe free · Data & exports documentation

Build your intelligence export