> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/threat-intelligence.md).

# Threat Intelligence

Nullify researches newly disclosed vulnerabilities and software supply-chain compromises once, for all customers, and then checks each published threat against your own environment: the repositories, dependencies, containers and deployments you have connected.

## How threats are found

Nullify follows public advisory sources, including OSV, GitHub security advisories, the National Vulnerability Database, the CISA Known Exploited Vulnerabilities catalog, EPSS scores and malicious-package reports, and adds its own research. Research publishes only facts it can corroborate from public sources, and every threat keeps the advisory identifiers it is known by.

Not every published threat is announced to every customer. Threats likely to need immediate action, such as an actively exploited critical vulnerability or a fresh malicious-package compromise in an ecosystem you use, start investigations. The rest stay in the catalog, where you can investigate any of them yourself.

## The Threats page

**Threats** lists the shared catalog with your tenant's assessment of each entry:

| Status             | Meaning                                                                                  |
| ------------------ | ---------------------------------------------------------------------------------------- |
| Not assessed       | No assessment has run for your tenant                                                    |
| Queued             | An assessment is waiting to start                                                        |
| Investigating      | An assessment is running; its progress streams live                                      |
| Affected           | The latest assessment found the threat in your environment                               |
| Not affected       | The latest assessment, on complete and current inventory, found no exposure              |
| Unknown            | The inventory was incomplete or out of date, so the result is not a clean bill of health |
| Failed             | The latest assessment did not complete; you can retry it                                 |
| Not run            | An assessment was queued but never started within its window; you can retry it           |
| Automation off     | Automatic investigations are turned off for your tenant                                  |
| Advisory withdrawn | The source advisory was withdrawn                                                        |

An assessment is tied to the research it read. When the threat's facts change materially, for example a new affected package or version range, the assessment is marked outdated and investigations whose answer could change run again.

## Automatic and manual investigations

Automatic investigations are a tenant setting: **Settings → Threat Investigations → Automatically investigate new threats**. They are off by default, and changing the setting needs configuration-write access.

Manual actions are always available from the catalog: **Investigate my environment**, **Retry** after a failure, and **Re-investigate** to run a new assessment version. A confirmed exposure to a critical, known-exploited vulnerability with a fixed release opens a remediation campaign.

## Investigation results

An investigation records which repositories and packages are affected, how complete the inventory evidence was, and a report with remediation guidance. Progress streams to the page while it runs. Results can be posted to your Slack or Microsoft Teams destinations; see the [Slack](/connectors/slack.md) and [Microsoft Teams](/connectors/microsoft-teams.md) connectors.

## Advisory identifiers

* A threat with a CVE, GitHub advisory or OSV `MAL-` id is known by those ids.
* A threat with none, such as a package compromise with no advisory yet, gets a permanent Nullify id, `NULLIFY-` followed by hexadecimal characters. It keeps that id if a CVE is assigned later.
* A threat you report is identified as `NULLIFY-R-…` until it links to a published threat. See [Reporting a threat](/capabilities/threat-intelligence/reporting-a-threat.md).

## Related capabilities

* [Dependency Analysis](/capabilities/code-reviews/dependency-analysis.md) reports known vulnerabilities in your dependencies as findings on every scan.
* [Supply Chain Posture Management](/capabilities/scpm.md) flags dependencies at a version Nullify's malware index has confirmed malicious.
* [Security Program Management](/capabilities/program-management.md) turns a confirmed exposure into a campaign.

## Limits

* An incomplete inventory gives **Unknown**, never **Not affected**. A threat that has not been assessed is not evidence that you are unaffected.
* Shared research is not billed to your tenant. Assessments of your environment count against your AI budget.

## API

See [Threat intelligence API](/api-reference/api-reference/manager/threats.md).