Platform

One platform. Only the intelligence that’s about you.

SignalCTI starts with your exposure — your domains, infrastructure, tech stack and suppliers — and pulls in only the threats that touch them. Every match is explained, scored and sourced.

Get early access See plans

Exposure profile

Tell us what you are, in under 5 minutes

Add the assets that make up your organisation. That profile is the filter every piece of intelligence passes through.

  • Domains, subdomains and IP ranges
  • Your tech stack and key products
  • Critical suppliers and their domains

Exposure profile · example

Domainsacme.example · 4 more
IP ranges203.0.113[.]0/24
Tech stackVPN gateway · M365 · Jira
Suppliers3 monitored

Threat matching

Intelligence, not noise

Signal matches actors, campaigns and indicators against your profile, so your team sees the handful that matter instead of millions that don’t.

  • Every match explains why it matched you
  • Confidence level and source count on every claim
  • TTPs (how attackers operate) in plain English

Matched to you this week · example

Phishing kit using your brandHigh
Actor targeting your VPN gateway modelHigh
Infrastructure scan of your IP rangeLow

Brand and lookalike domains

See impersonation before your customers do

We watch new domain registrations, certificates and phishing kits for anything pretending to be you.

  • Lookalike and typo-squat domains as they’re registered
  • Phishing kits and pages using your brand
  • Evidence ready to send to your takedown provider

Lookalike domains · example

acme-login[.]exampleHigh
acrne[.]exampleHigh
acme-support[.]exampleLow

Dark-web and leak monitoring

Know when your data turns up somewhere it shouldn’t

Leaked credentials, breach dumps and mentions in criminal forums, tied back to the domains and suppliers in your profile.

  • Exposed credentials for your domains
  • Breach data mentioning you or a supplier
  • Context on who is selling, and how credible they are

Leaks · example

12 credentials for your domain in a new dumpHigh
Supplier named in a forum sale listingLow

Vulnerability intelligence

The CVEs that matter to your stack

Not every critical vulnerability is your critical vulnerability. We flag the ones in products you run, and whether attackers are using them now.

  • Matched to your tech stack, not the whole CVE feed
  • Signals of active exploitation in the wild
  • Clear next steps for your team

In your stack · example

VPN gateway: actively exploitedHigh
Collaboration suite: patch availableLow

Integrations and API

Open by default

An API on every tier, including Free. Push intelligence into the tools your team already uses, in open standards.

  • STIX/TAXII 2.1 server
  • Microsoft Sentinel, Splunk, Elastic and CrowdStrike
  • Alerts in Slack and Microsoft Teams

api.signalcti.com

GET /v1/exposure/matches?since=7d
GET /v1/indicators?type=domain
TAXII 2.1 · /taxii2/collections

Start free. Upgrade when you need more coverage.

Join early access and be first to the free tier.

Get early access