About Orbitaley and our methodology

What we cover

• Vulnerabilities (CVEs): a page for each CVE with its severity (CVSS), exploitation probability (EPSS), confirmed active exploitation (CISA KEV catalogue), public exploits, affected technologies and MITRE ATT&CK techniques.
• News: alerts on the vulnerabilities that deserve attention, follow-ups when exploitation is confirmed, notable ransomware victims and new threat groups.
• Reports: very high-interest stories investigated in primary sources, with every key fact verified and sources cited.
• Threats: ransomware activity by country and sector, and profiles of each group (how it gets in, tools, exploited vulnerabilities, techniques and priority mitigations).
• Weekly bulletin (every Monday): most active groups, affected regions and sectors, confirmed victims, new groups and concrete measures.
• Glossary of cybersecurity terms in English and Spanish.

Where the data comes from

We use public and official sources, and cite the sources of every news item:

• NIST's NVD (National Vulnerability Database), synchronised every hour.
• CISA's KEV catalogue (actively exploited vulnerabilities), every hour.
• FIRST's EPSS (exploitation probability), daily.
• Public exploits from Metasploit, Exploit-DB, Nuclei and proof-of-concept code on GitHub, every six hours.
• Vendors' own security advisories, often before NVD publishes the CVE.
• MITRE ATT&CK and MISP Galaxy for groups, aliases, software and techniques.
• Over a hundred news and research sources (research blogs, national CERTs and specialist press) in around twenty languages.
• The claims ransomware groups post on their leak sites. We never link to those sites or to stolen data.

How we select vulnerability news

Each CVE gets a score that combines its severity (CVSS), the market relevance of the affected product, its exploitation probability (EPSS), the existence of public exploits and its press coverage. It is published only if it passes a high threshold and the product is relevant; a vulnerability that CISA reports as actively exploited is always published if it affects a relevant technology.

CVEs in the same technology are grouped: a vendor's monthly update is a single news item, extended if more CVEs arrive in the next 24 hours. Each item is based, where they exist, on the vendor's own advisories.

How we verify

• A ransomware group's claim is not a fact: we always present it as an unverified claim. If the organisation or the press later confirms it, the item is rewritten to say so.
• Before publication, an independent reviewer compares each text with the source data and holds it back if it states something not in the data, contradicts it or presents a claim as fact.
• For reports, a fact-checker reopens the sources of the key facts, every figure must be documented and a supervisor decides whether the piece is published. No report is produced without an editor's prior approval.
• Data protection: we never name natural persons (employees, executives or alleged perpetrators), and victims who are natural persons are anonymised.
• Corrections: when a fact changes, we edit the published item (and its Telegram message) rather than publish another one.

Use of artificial intelligence

Orbitaley uses AI models to classify, extract data from sources, translate and write from structured data. Every text is written only from the source data and goes through the checks described above: the reviewer holds back any text with a fact that is not in those sources.

Who it is for

For security and IT leaders, IT teams and executives who need to know, without the noise, which vulnerabilities and threats affect their organisation. Everything public on Orbitaley is open and free: the website, RSS, Telegram channels in English and Spanish, and X. A free account (with a company email) adds a personal dashboard, the daily digest, real-time alerts and monitoring of the external assets the organisation declares.