Threat Visions is a defensible seven-dimension aggregation of Internet-scale cyber risk — Vulnerability, Exploitation, C2/Malware Infrastructure, Threat Actors, Outages, Ransomware, Supply Chain (the VECTORS acronym) — computed live from authoritative public sources. Each dimension is scored independently and combined under a transparent weighting. The index reads global Internet threat conditions from the outside-in; it is not a company-specific internal cyber risk score.
| Factor | Current | Normalization | Weight | Contribution |
|---|
| Factor | Current | Normalization | Weight | Contribution |
|---|
| Factor | Current | Normalization | Weight | Contribution |
|---|
| Factor | Current | Normalization | Weight | Contribution |
|---|
| Factor | Current | Normalization | Weight | Contribution |
|---|
| Factor | Current | Normalization | Weight | Contribution |
|---|
/api/supply-chain that watches CISA Cybersecurity Advisories and Analysis Reports for registry/repo compromise language. Replaces the old Systemic Stress dimension in r46.| Factor | Current | Normalization | Weight | Contribution |
|---|
Internet-scale cyber risk is multidimensional. What is exploitable, what is being weaponized right now, what machinery attackers have built, who is operating, what is already disrupted, how active is ransomware, and how compromised is the software supply chain — these are seven separate questions. Collapsing them into a single weighted sum hides the picture. Threat Visions keeps all seven visible and combines them transparently:
The brand is Threat Visions. The technical acronym VECTORS names the seven dimensions in display order: Vulnerability, Exploitation, C2/Malware Infrastructure, Threat Actors, Outages, Ransomware, Supply Chain. Each dimension is bounded 0–100 and computed independently. All seven move in the same direction — higher = worse — so the composite reads as a single risk thermometer.
This index reads global Internet threat conditions from the outside-in. It is not a company-specific internal cyber risk score — it measures the wider Internet's health using only public, authoritative sources.
VECTORS replaced the earlier TVIEWS methodology in r46 (2026-05-13). Two structural changes accompanied the rename: the old Weaponization dimension was split into C2 infrastructure and Threat actors (those signals had always been distinct); and the old Systemic Stress dimension — which had measured concentration risk and cloud/CDN outages — was retired in favor of Supply Chain, which measures pressure on the software trust graph (npm, PyPI, GHSA, OSV, Sigstore) and on CISA-confirmed registry/repo compromises. Concentration risk moved into Outages. Ransomware was promoted from a sub-signal under the old Threat dimension to its own dimension, since it is the consequence layer most operators track separately.
Cyber telemetry has long tails — port-scan record counts can range from 1 to 10,000,000. Linear weighting either makes outliers blow up the index or makes everyday signal vanish. Each count input is normalized as log₁₀(v + 1) / log₁₀(ceiling + 1), clamped to [0, 1].
Ceilings are calibrated to "high but not catastrophic" levels — for KEV adds 7d the ceiling is 20; for active C2 servers it is 500; for top-port records it is 1,000,000.
Every input is sourced from a public-record authoritative feed: NVD JSON 2.0 for CVEs, CISA KEV for known-exploited vulnerabilities, FIRST.org EPSS for exploit-prediction scoring, SEC EDGAR for Item 1.05 cyber disclosures, abuse.ch Feodo for active C2, SANS DShield for probe records, ransomware.live for victim posts, and named-actor extraction from Mandiant, CrowdStrike, Microsoft Threat Intel, Talos, Kaspersky, and SentinelLabs blogs.
No proprietary scoring is opaque-boxed; every weight, ceiling, and source is in the page source.
Weights and ceilings are tuned so a routine day reads NORMAL or low GUARDED. When the index climbs, it means something. Specifically: a typical day with a handful of high-severity CVEs, normal KEV flow, and one or two minor incidents reads around 20–35. A day with a critical zero-day, multiple ransomware victims, and a major-provider outage reads 55–75. A multi-incident crisis with regulatory disclosures stacking, or a CISA-confirmed supply-chain compromise, reads 85+.
The composite is a heuristic, not a standard. The advantage of transparency is that disagreements about weights are productive — change one number and watch the index move.